KVH strengthens ransomware protection, cuts backup time by over 70%

The Challenge

The business of healthcare revolves around managing vast quantities of data subject to stringent security, privacy, and compliance requirements. Challenges for KVH include complying with Germany’s Patient Data Protection Act and the EU’s General Data Protection Regulation (GDPR), retaining doctors’ invoices for 10 years, and making sure employees can quickly access invoices, contracts, files, and other data to ensure residents receive needed care and that doctors get paid.

Until 2015, KVH stored data relevant to billing and other file types on Windows File Servers which had their disks on Dell EMC VNX storage, mirrored between data centres. In addition, KVH used Dell EMC NetWorker and Data Domain for backup and restore. “But as data volume grew, performance started to really slow down,” says Christian Zinke, Team Lead for IT Infrastructure at KVH. “Backups took seven hours and finding a lost email file or document in the GUI from Dell EMC NetWorker to restore files often took 45 minutes or more—a big problem since we have only one storage administrator.” The IT team often had to wait months to find a window to install Windows security patches on the Windows file servers, leaving KVH vulnerable to malware. It was also difficult to
extend disk space as all of the file server disks passed 2 TB. With a Master Boot Record (MBR) partition table, partitions are limited to a maximum of 2 TB. Therefore, the limit of scalability was reached.

Concerned about rising attack volume, KVH also wanted ransomware protection. “We needed a set of backups that attackers couldn’t delete or alter,” Mr. Zinke says. The German government restricts companies in the public sector from processing social data, so the new data management platform had to run on-premises or in colocation facilities.

The Solution

Comparing Cohesity to Dell EMC, Mr. Zinke selected the Cohesity data security and management platform. “Cohesity stands out because of its performance, modern architecture, and security protections, including built-in antivirus and immutable backups,” he says. “And support is simpler with one vendor for backups, disaster recovery, and ransomware protection.”

Initially, KVH deployed two Cohesity clusters, one in the primary data centre and another in a disaster recovery location. At about the same time, they replaced the Windows file server with Cohesity SmartFiles. “With SmartFiles we can scale up and out as data volume grows,” Mr. Zinke says. “And we don’t have to schedule a maintenance window
for updates because our users can continue accessing files while the update is happening. We now have access to the latest features as soon as they’re available.”

By 2022 data had grown to over 300 TB, and ransomware had become a bigger threat. KVH asked Cohesity to optimise the existing Cohesity data management solution. The result: today all data and files are stored in separate locations for optimised security. Cohesity SmartFiles and the primary Cohesity backup cluster are in the main data centre. They replicate to a disaster recovery facility and to a new separate site used expressly for ransomware protection. Like the Cohesity FortKnox cloud service, all backup data is ransomware-protected on all backup clusters. The new separate cluster also stores immutable backups that can’t be deleted, encrypted, or modified as an air-gap vault with even higher security and access implementations.

KVH is also using Cohesity to archive data for virtual machines. Storing a VM on a Cohesity cluster is a simple and efficient way to make sure the data is available when needed. Using features like DataLock prevent the data from being deleted or modified, and allow KVH to meet compliance requirements to archive the data for 10 years.

The Results

Now KVH has a stronger security posture, including ransomware protection. “If we’re hit by ransomware, we can quickly restore from the immutable backups in our on-premises data vault,” says Mr. Zinke. For added protection, he’s getting ready to require administrators to use Cohesity multifactor authentication (MFA) before they can access data, and to use Cohesity’s DataLock feature to prevent deletion of data by anyone, under any circumstances, until a specified date. The open-source ClamAV app runs right on SmartFiles, eliminating the need to migrate to, and manage, separate antivirus infrastructure. “Using Cohesity immutable backups and ClamAV significantly lowered our premiums for ransomware insurance,” Mr. Zinke says.

Storage efficiency has increased, reducing physical storage costs. KVH now stores more data in less space by taking advantage of Cohesity’s data reduction, including cross-volume data deduplication, compression, and optimised storage of small files. “We’re seeing 5:1 data reduction ratios and storage reduction of 49.2x, pointing to the efficiency of the Cohesity solution.”

When users lose data, an administrator can now find it much faster with Cohesity’s ability to index all data stores on the platform. Apps like Spotlight, a Cohesity Marketplace app, can provide even more insight into the data. “Before, our administrator had to scroll through multiple folders to lost file, which often took 45 minutes,” says Mr. Zinke. “Now, with Cohesity, the admin simply enters the file name to find it, and can typically start the restore in under five minutes. Users get their file sooner, and if we do three to five restores a week, our administrator saves about three hours.” An added benefit is if the administrator discovers that the file is not really lost—just hiding out in a different folder—KVH avoids making an unnecessary duplicate.

VM failures don’t interrupt work. With KVH’s old backup solution, when a VM failed employees had to pause their work until it was fully restored. No longer. “Cohesity integrates very well with VMware vCenter,” Mr. Zinke says. “If a virtual machine fails, users can work on the backup copy, using Cohesity Instant Recovery, as it’s migrated back to production. We’re now more resilient.”

Summing up the value of Cohesity, Mr. Zinke says, “Cohesity is much more than a backup or disaster recovery solution—we also use it as a more modern and scalable alternative to Windows File Services, and for ransomware protection.”