Sky Lakes Medical Center avoids paying ransom, lowers PACS TCO

Sky Lakes Medical Center is a not-for-profit teaching hospital serving more than 80,000 people in south-central Oregon and northern California. When the Information Services (IS) staff looked to replace aging data center infrastructure, it teamed with CDW to choose a joint solution from strategic partners Cisco and Cohesity for modern, efficient data management. Little did Sky Lakes know that its new reliable and simplified backup and disaster recovery (DR) platform would soon be a cornerstone to its IT security, helping Sky Lakes recover from a ransomware attack while achieving cost-efficient picture archiving and communications system (PACS) file service and giving IT staff more time to focus on other important work.

The Challenge

The successful Sky Lakes data center infrastructure refresh to Cisco HyperFlex, a hyperconverged compute, storage, and networking system, reduced the costs and operational burdens of three different solutions and vendor contracts for the lean IS team. So as the renewal of Sky Lakes aging Commvault backup product neared, IS staff was interested in guidance from both CDW and Cisco as it evaluated new backup and data management approaches that were easier to use and would drive further efficiencies. The goal was to give engineers greater bandwidth to proactively fulfill all of the requests coming in daily.

After Cisco’s recommendation and seeing it perform, Sky Lakes purchased and quickly set up Cohesity to manage backup and unstructured data while continuing to use Cisco HyperFlex for primary (latency-sensitive) data on Cisco Unified Computing System (UCS) servers with Cisco Intersight as the single management user interface for both. Sky Lakes was among the first to test and deploy the validated Cisco-Cohesity 40G design.

The Solution

Cohesity software on Cisco UCS for data management was far easier for Sky Lakes to deploy and use than its prior legacy product. Cisco Intersight reduces IT operations time and allows oversight of the entire infrastructure, including Cisco HyperFlex and Cohesity-certified Cisco UCS nodes. IS no longer has to manually add servers to the backup queue because Cohesity automatically detects and protects each virtual machine (VMs) and workload while enabling Sky Lakes IT to tag only those it does not want to have backed up. This eliminated the need for IS staff to scramble to do a restore data.

Sky Lakes sees tremendous value in the Cohesity multicloud data platform because it supports multiple data services. In addition to modern backup, Sky Lakes relies on Cohesity SmartFiles, a software-defined solution for file and object services that goes beyond traditional scale-out NAS within the same cluster. Complementary to Cisco HyperFlex, SmartFiles lowers Sky Lakes PACS total cost of ownership (TCO) by using Cisco HyperFlex as a cache tier for radiology images and Cohesity cluster as an archive tier. As a result, Sky Lakes no longer uses more costly primary storage for PACS archives. IS expects to use the same configuration for camera systems.

When Sky Lakes was unexpectedly targeted and breached by a massive ransomware attack in October 2020, the healthcare provider immediately contacted the trusted experts in solving complex challenges. Together, CDW, Cohesity and Cisco served as a rapid-response data management team for Sky Lakes as it defended its data against ransomware. Cohesity immutable backup snapshots, DataLock and other built-in protections that deter, detect and rapidly recover data at scale from a ransomware attack empowered IS to say no to the cybercriminal’s demands.

“Our organization suffered a critical ransomware attack, effectively crippling our entire infrastructure. With Cohesity, we’ve been able to recover machines and file shares, verify they’re clean, and bring the applications back online. Cohesity has literally saved us hundreds of hours of work and I’d say it prevented us from having to actually pay the ransom note. We all still have jobs and the community has a functional hospital because we have had so much success with Cohesity,” says Sam Stewart, Sky Lakes Network Systems Analyst.

Among the keys to recovery were CDW’s depth of experience quarterbacking partner teams for successful outcomes and the power of the Cohesity-Cisco solution. Cohesity was able to give IS staff access to a granular version of the organization’s Active Directory database. And Cohesity-Cisco solution’s fast, simple data restores enabled patients that regularly rely on the Sky Lakes Cancer Treatment Center to continue their treatments without being sent elsewhere and inconvenienced. “In this case, it’s not an exaggeration to say that Cohesity saved lives,” explains Nick Fossen, Manager of Technology Solutions at Sky Lakes.

Sky Lakes was also able to instantly restore its file services because of Cohesity’s unique Cohesity SmartFiles capability, which supports SMB, NFS, and S3 Object. Moreover, Sky Lakes was able to instantly clone the last good backup of its NAS shares and serve those files directly from the Cohesity cluster—recovering the service to users without the need to move data.

Cohesity works hours faster than the traditional products that Sky Lakes used for backups. Before the attack, for example, a PACS vendor corrupted an SQL database at 6:30 p.m. and contacted an engineer who was able to quickly log into Cohesity remotely, discover the last fully hydrated backup from 30 minutes prior, and completely restore the entire database in 2 minutes and 40 seconds. Previously, this would have taken multiple hours. And in every case with Cohesity, IT has had the choice to bring back a server with separate VMs and SQL backups to different time periods.

Additionally, Cohesity bolsters the Sky Lakes DR strategy. Cohesity running on Cisco UCS is used as a bi-directional replication target, allowing the provider to have two, high-capacity sites mirroring each other for DR.

“We’re trying to deliver quality healthcare with limited budget and resources,” explains Sky Lakes Director of IS, John Gaede. “Cohesity is reliable and on top of that, we get the ease-of-use value and the speed at which it performs. All of Cohesity’s innovation helps our engineers do something immediately and then quickly move to the next task. Now as my team says, it’s also putting ransomware extortionists out of business.”

The Results

CDW, Cohesity and Cisco are a winning combination for Sky Lakes IS. The comprehensive, integrated Cisco – Cohesity hyperscale data management solution empowers all Sky Lakes engineers to perform backups and DR as well as handle file and object services while strengthening security, including rapid recovery from the ransomware attack. Cohesity eliminated time-consuming tape backup recovery processes, speeding restores with no data loss. “If we had not teamed up with CDW to learn about the Cisco-Cohesity solution, and had still been using our legacy product and had to go back to tape, it would have taken us weeks, not minutes, to recover. And because we only save 90 days, we would have lost roughly three months of data. With CDW, Cohesity and Cisco, we lost nothing,” says Fossen.

In addition to defending against ransomware, Cohesity simplifies everyday tasks and lowers PACS costs. It also reduces staff stress because engineers don’t need to spend an hour or two remembering steps and creating a policy every time a new server is added. Moreover, high-performance Cohesity indexing and search across the IT environment lets IS staff more quickly find specific information when they need it most.

Key Benefits

• Simplified backup, DR and file services
• Avoided ransomware payment
• Rapid data recovery with no data loss
• Lower PACS system TCO – Cisco HyperFlex for a cache tier and Cohesity for an archive tier
• Stronger security posture

About Sky Lakes Medical Center

Sky Lakes Medical Center is a not-for-profit, community-owned, internationally accredited acute-care teaching hospital dedicated to the people it serves. Sky Lakes serves more than 80,000 people in Klamath and Lake counties in south-central Oregon, and Modoc and Siskiyou counties in northern California