Spring Independent School District thwarts ransomware attack with Cohesity on AWS

The call dreaded by school-district IT teams came one evening in November 2020: a ransomware attack was underway. Fortunately, Spring Independent School District (ISD) had recently switched to Cohesity DataProtect. They store one immutable copy of virtual machines (VMs) and databases on-premises and another on AWS. Before school started the next day, the IT team had restored its Active Directory servers and critical learning servers from AWS. Finance and the Student Information System—were back online just two days later. No disruption to learning. No impact on payroll. No ransom paid.

The Challenge

Like school districts everywhere, Houston-area Spring Independent School District (ISD) is strengthening defenses against growing cybersecurity threats. “We block 1.4 million attacks every month, do regular penetration testing, and offer year-round cybersecurity training to staff,” says Bobby LaFleur, Director of Application of Support. “But nothing is foolproof and IT has to be vigilant about vulnerabilities, so part of our strategy is making sure we can quickly recover failed or locked up virtual machines and files to make sure learning and administration aren’t interrupted.”

Spring ISD previously used multiple backup products: Veeam for virtual machines, Idera for SQL Server, and two different server platforms. The whole setup was replicated in a nearby co-location facility used for disaster recovery. When the co-lo lease came up for renewal, the IT team explored better solutions. “Managing four separate interfaces is complicated, and it took a lot of staff time,” LaFleur says. “The co-lo wasn’t ideal for disaster recovery because it’s susceptible to the same weather-related risks as our local backups. And a sophisticated ransomware attacker could go after our backups and exploit our data.” That’s what happened in a neighboring district that had been hit by a disruptive ransomware attack in October 2020.

The Solution

The IT team found its solution in Cohesity DataProtect, which replaces all four of the district’s legacy data-protection products. Recommended by the district’s IT partner, SHI, Cohesity automatically backs up 60 terabytes of VMs and databases in two locations—in the district server room and in AWS for archiving and disaster recovery. “Cohesity saves a lot of time for our engineers because it automates tasks we used to do manually, like replication and archiving,” says LaFleur. What’s more, the Cohesity backups are immutable, thwarting attackers’ attempts to encrypt or delete them. “If any virtual machine or SQL Server is encrypted in an attack, we can instantly restore a snapshot to any point in time,” LaFleur says.

The Results

Ransomware protection paid for itself many times over when the district was hit by an attack in November 2020—a date etched into LaFleur’s memory. “We got a call around 8:00 p.m. about errors in the remote learning systems we were using during the pandemic,” he says. When IT engineers saw that an attack was propagating through our file servers, LaFleur and his colleagues on the infrastructure and network teams rushed to the office to temporarily shut down the network.

“After the ransomware attack, Cohesity really saved us,” LaFleur says. “Though our local Active Directory servers were locked up, preventing us from restoring data from the local backup, we were able to quickly restore critical servers from Cohesity backups on AWS. Teachers taught online classes the very next day as usual, and we didn’t miss payroll. When a neighboring district that didn’t have Cohesity was hit by a similar attack, they had to pay a hefty ransom and didn’t fully recover for almost four weeks.” The remaining 200 servers—mainly secondary systems, were brought back online in a planned manner.

District IT engineers like the simplicity and efficiency of Cohesity. Before, restoring a lost or corrupt file required restoring the entire database, which took five or six hours. Now they can search for and restore an individual file in minutes. “Whether I restore data from the on-prem backup or the AWS archive, I can do it from a single user interface instead of bouncing between systems like we did before,” says Roberto Solorzano, Senior System Engineer. “Since we started using Cohesity, I get more sleep.”

The Spring ISD administration and board appreciate that stronger protection costs less, not more. “With Cohesity we lowered TCO by 10-15% by decommissioning four legacy backup products, eliminating co-lo lease and equipment costs, and simplifying management,” LaFleur says. “And ransomware protection helped us get favorable rates when we renewed our cybersecurity insurance.”

Summing up, LaFleur says, “When peers in other school districts ask what we use for data protection, I tell them it’s Cohesity—and that I’m very satisfied with our chosen partner!”

Key Benefits

• < 12-hour recovery of vital servers after ransomware attack
• No ransom paid
• Helped qualify for favorable cybersecurity insurance rates
• Faster file restoration—minutes instead of 5+ hours
• 10-15% lower TCO

About Spring ISD

The Spring Independent School District serves over 35,000 pre- kindergarten through 12th-grade students in a diverse district located 20 miles north of central Houston. Ranked 12th in the state of Texas by size, the district has 43 campuses, including 25 elementary schools, nine middle schools, six high schools, and three ninth-grade centers.