Case Study: Compushare Holds The Key To Securing Bank's Backup Data

The bank's tape-backup system, which covers all of its databases and documents, was kept in a locked room in three locations, and only five top executives had a key, said Jack Buchold, CFO and executive vice president of the Reno, Nev.-based bank.

In October 2002, a federal regulator said Nevada Security could be compromising its security by leaving the data in the hands of five individuals.

In response, the bank installed new storage cabinets in the backup rooms. Each of those cabinets had two locks.

"But the problem was, every time we did a backup, someone had to get a key from one of the five executives and then the two rack keys," Buchold said. "That's a total of three keys, and we had to do this for all three locations daily."

But getting the keys wasn't the only hassle. "What if the primary administrator was sick and his backup wasn't there, or if he forgot to do the backup?" Buchold said. "It happened once, and there was no backup that day."

And there was another problem with Nevada Security's backup system: A lot of data resided on employees' desktop hard drives and wasn't being backed up at all. "If a drive crashed, the data would be gone," Buchold said.

Enter Compushare, a South Coast Metro, Calif.-based solution provider specializing in financial services companies,especially community banks and credit unions. Compushare, in fact, had installed the bank's first IT infrastructure a few years prior, when the bank first opened its doors.

As it turned out, one of Compushare's partners and customers was Aurum Technology, a Plano, Texas-based outsourced service provider for banks.

Nevada Security was already outsourcing protection of its customer database to Aurum, said Tom McInerney, director of client solutions at Compushare. "When Jack [Buchold] saw our relationship [with Aurum], that took out the risk," he said.

Compushare decided that the key to solving Nevada Security's backup woes was to deploy a system that allowed for automatic data backups over the Internet, McInerney said. To do that, he chose two products from EVault, a software vendor in Walnut Creek, Calif.: EVault InfoStage, for data protection and recovery, and EVault Protects, a disk-to-disk backup service.

Compushare got involved with EVault after an employee noticed that other customers were using the software company's products to solve problems similar to Nevada Security's. Compushare tested EVault's software and eventually signed up with the company as a solution provider partner, McInerney said.

Once the solution was decided upon, Compushare brought in EVault to do an initial copy of all Nevada Security's data onto a storage array that Buchold called a "black box." Evault then transferred the data to the remote data-backup site.

Compushare's next step was to set up a routine so that all of Nevada Security's desktop-based data is backed up to the servers automatically.

Server-data changes are then backed up to the remote site at every night, Buchold said. The bank is notified by e-mail if there are any problems with the backup, he said.

So far, Nevada Security has benefited in two ways from Compushare's automated backup solution, said McInerney. "First, Buchold knows he's in compliance with regulations," he said. "He also knows that his data is backed up and available if needed."

Buchold said the automated backup system eliminates problems related to backup-tape access, IT personnel calling in sick and data being stored on too many desktop hard drives.

The system sends a warning to Nevada Security if there's a problem with the backup, but the absence of a warning doesn't necessarily mean the backup process is free and clear, Buchold said, adding that Compushare is currently working to fix that.

In the meantime, Nevada Security's relationship with Compushare continues to evolve, Buchold said. "They're a good group of people," he said. "We're now working with them

to set up our intrusion-detection system."