The case for electronic data vaulting.

As IT director at the Rural Wisconsin Health Cooperative, it's Darrell Statz's responsibility to see that every part of the technology infrastructure is running smoothly. It's not necessarily an easy job; the cooperative was formed in 1979, and is jointly owned and operated by twenty-nine rural acute, general medical-surgical hospitals located throughout the state. While RWHC member hospitals combine their strengths to meet local community health needs, they have also moved to reduce their costs at the same time.

Data protection and disaster recovery is one key area, and it's been Statz's job to establish and run a central off-site data center in Madison, about 30 miles from RWHC's headquarters in Sauk City. Prior to its establishment, each member hospital was responsible for protecting its own data. Most backed off their data to tape, and carried the tapes offsite each night. Many of the hospitals agreed, however, that physically transporting the tapes in a "SneakerNet" configuration was inconvenient, and potentially dangerous. Tape reliability was an issue: they could be misplaced or damaged far too easily; mirroring many of the same unreliability issues they have had for more than 30 years. They were seeking a better solution that would offer RWHC members a more secure way of protecting their data at a price they could afford.

Statz found a solution that would not have been considered technologically or economically feasible until recently: he's begun implementing electronic data vaulting (EDV) from RWHC member hospitals to the group's Madison data center. Other small and mid-sized businesses (SMBs) have begun doing the same thing. One of Wisconsin's leading law firms, Whyte Hirschboeck and Dudek, needed to establish a centralized offsite disaster recovery system to protect data from its three offices in Milwaukee, Madison and Manitowoc. Shuttling tapes from the three cities was not a viable option, given the firm's limited IT staff and distances involved. Like RWHC, Whyte Hirschboeck implemented an EDV system to ensure the safety of its information.

Both organizations cite several factors in their decision, including the need for greater data security, and the plummeting cost of hard drives, making EDV an increasingly viable alternative. In doing so, they're taking part in an increasing trend that may ultimately end in the demise of the SneakerNet.

"Electronic data vaulting is an area generating a surprising amount of interest among SMB organizations," according to Phil Goodwin, president of Diogenes Analytical Laborato-ries, one of a number of market observers who believe SneakerNets are on the decline. "The attraction seems to be stimulated by the ability to kill two birds with one stone: consolidate data from remote offices according to a best-practices plan while protecting that data from disasters and theft," he says.

"The best way to get rid of SneakerNets is to explain it to an IT manager as if it's just another data transport mechanism and let them make the choice for themselves," says Brad O'Neill, senior analyst with the Taneja Group. "Most teams are focused on the positives of sneakering, but ignore the downside. The good news is that SneakerNets are cheap. The bad news is that they are extremely slow, totally unsecured, and untraceable by your team at any given time. Data loss will be catastrophic and 100% unrecoverable, to the point that a corporation would face significant legal, PR, customer, and perhaps market value issues as well."

O'Neill is on point: more than 9.3 million Americans were the victims of identity theft last year, according to a draft of the "Personal Data Privacy and Security Act of 2005," a bill currently being considered by Congress, following the reported loss of storage tapes containing personal data about customers and employees by numerous companies, including Citigroup, Ameritrade and Time Warner. In Citigroup's case, The Wall Street Journal reported "the records were lost by United Parcel Service while the delivery company was taking them to a credit-reporting agency, despite what the company described as 'enhanced security procedures.'"

The Act, if it becomes law, would require firms that handle or store information about more than 10,000 Americans to companies to impose tighter controls on the security of their data, including conducting risk assessments, implementing management controls, training its employees, and performing "regular testing of key controls, systems and procedures" to detect vulnerabilities. It almost goes without saying that tapes filled with personal information, crammed in a box to be shipped to an offsite location, may leave the data contained on them in a vulnerable position.

While the so-called Specter-Leahy Act, named after its sponsors, is still in a Congressional committee, other laws like Sarbanes-Oxley, HIPAA and Gramm-Leach-Bliley are already in effect. HIPAA, notably, requires that companies' data protection methodologies ensure the security and confidentiality of patient records.

Which is where using EDV for disaster recovery makes sense, especially in a two-tier implementation, according to Mark Phillippi, product manager at Unitrends, a South Carolina-based firm that makes data and system protection appliances. All of Unitrends' Data Protection Units (DPUs) come EDV-enabled, allowing end-users to hook as many as ten servers to each DPU and perform a local, block-based incremental data backup across a LAN. As each individual server completes its data transfer, the data is then automatically transmitted to a Data Protection Vault (DPV), located at an offsite location. "Rapid file-level and server-level restores can be handled onsite within minutes, as opposed to the hours required when the data to be restored is stuck on an offsite tape. If an entire site goes down, including the DPU, the central DPV can be used to quickly restore the most recent data and get the site back up and running."

Phillippi quickly points out that tape still has a role in a complete data protection system, but only in archiving for achieving compliance under HIPAA and other regulations. He notes that a WORM tape library can be installed off the back of the central DPV to save data in what the rules refer to as a "non-volatile manner;" that is, in a way the information can't be changed or erased.

In addition, there are traditional technology factors that have a number of SMBs either considering or taking advantage of EDV:

Complexity: Establishing an adequate tape backup procedure may be an involved undertaking for SMBs, whose slim IT departments are often taken up with day-to-day maintenance chores. Adding a myriad of operating systems to the mix, such as Windows- or Linux-based servers, only adds to the complexity of the data management task.

Configuration: A true disaster recovery solution requires that companies back up not only its data, but the underlying operating system as well. But bandwidth limitations may limit companies' ability to accomplish this; the amount of data to be shipped offsite is simply too much, narrowing already-cramped backup windows. Two-tier architectures, allowing for rapid initial onsite backup, followed by less band-intensive EDV to an offsite location, is seen by many early adopters as a preferred method.

At the Rural Wisconsin Health Cooperative, Darrell Statz is driving the group's move away from SneakerNetting tapes, to a system where data is electronically collected in a two-tier implementation, and transmitted in a HIPAA-compliant manner to an offsite DPV at the Madison data center. "Tape simply does not make sense any longer for many of our member hospitals," Statz said. "We believe that disk-to-disk data protection, coupled with electronically vaulting the data offsite for additional safeguarding, clearly provides the speed and reliability our hospitals require." Three of the RWHC's member hospitals are already electronically vaulting their data; five more are scheduled to install DPUs shortly after the first of the year.

Al Ciochon, IT director at Whyte Hirschboeck, says dependability, ease of use, and the ability to operate with limited staffing were key factors in his decision to implement an EDV system between his firm's three offices; like Statz, Ciochon runs Unitrends' DPUs and DPVs. "We were looking for a way to stop shuttling tapes as our primary method of doing disaster recovery. Vaulting the data to a central location from multiple sites has helped us move toward that goal. We've found it to be more efficient, and gives our IT staff one less thing to worry about. In other words, SneakerNetting tapes from point 'A' to point 'B' simply doesn't makes sense for us any longer."

Industry analysts aren't quite ready to pronounce SneakerNets DOA, not yet, anyway. But they acknowledge that cost and other factors are making a complete EDV implementation far more attractive for small and mid-sized businesses than it was even a year ago.

"The cost of networks and midtier disks continue to trend downward, as does the cost of replication software, even as their capacity and performance continue to increase. This means that over the near term, electronic data vaulting may prove to be more economically viable for small and mid-sized companies," says Dianne McAdam, Senior Analyst and Partner at Data Mobility Group. "Economic considerations notwithstanding, the growing impact of existing and potential regulations like HIPAA and Specter-Leahy make it far more likely that SMBs will have to take additional steps to ensure the security of their data at every point, from acquisition to archiving."

Steve Friedberg is a writer and consultant in Philadelphia, PA

www.unitrends.com