SBA rolls out backup system

Only a typhoon in Guam and some unexpected snags have kept the U.S. Small Business Administration from finishing the agencywide rollout of its new offsite data backup and recovery program.

With most sites up and running, the outsourced service already is providing better protection for the agency's data, while freeing up SBA's busy technical services staff to spend time on other projects.

The service, which is hosted by Iron Mountain Inc. and uses Web-based software from LiveVault Corp., backs up data from SBA's Washington, D.C., headquarters and about 90 regional and branch offices. It then sends the data over a secure Internet connection to an offsite facility where it is stored first on disk, then copied to tape and kept for up to seven years.

The service replaces a hodgepodge of backup gear and procedures that local SBA information managers handled independently at each office. These routines could be disrupted by faulty equipment or if employees were out sick or busy on other projects.

"Our motivation was to improve efficiency in terms of people not losing work or spending a lot of time recovering work, and to reduce risk associated with our previous backup and recovery procedures, which were totally dependent on people carrying out the job," said Lawrence Barrett, the SBA's chief information officer.

Indeed, a chief benefit of the electronic vaulting service is the "set it and forget it" nature, requiring little ongoing administration work after the initial setup, according to Harry Ebbighausen, president of Iron Mountain's offsite data protection services unit.

The SBA's rollout of the vaulting service, which began in April, coincides with an agencywide initiative to upgrade all of its desktop computers and local-area networks, Barrett said.

Setting up the service involved installing a small piece of LiveVault software on each server and identifying the files or data that needed to be backed up. The servers were then configured to send the backup data over the Internet, via a connection with SBA's wide-area Frame Relay network, to Iron Mountain's offsite storage facility.

"We're backing up user data continuously -- e-mails, word processing documents, spread sheets, and backing up the system files, which don't change as often, two times a day," said Sherry Hill, director of communication technology services at SBA's office of the CIO.

When a user needs to restore a lost, corrupted or deleted file, the local SBA information manager can use a Web browser-based console to retrieve a copy via the Internet from the Iron Mountain vault. If an entire SBA system is lost and it's impractical to send all the data over the Internet, Iron Mountain will deliver the backup copy to the local office on a tape or loaded on the disks of a network attached storage appliance.

LiveVault addresses security on several levels, according to David Ryter, vice president of marketing at LiveVault Corp.

"We use a digital certificate mechanism to communicate with every server, and we encrypt all data transmissions using AES [Advanced Encryption Standard]," he said. The software also maintains access control lists that govern who can access protected data and administrative features.

Lastly, SBA officials received a modification to the service that allows a branch office employee access only to that location's electronic records.

The SBA pays $35 to $50 per gigabyte of protected data for the service, depending on the total amount of data, and expects the entire agency's bill for the service to be about $300,000 to $400,000 per year, Barrett said.

For now, the LiveVault software only works with Microsoft Corp. Windows-based systems, but Ryter said the company plans to add support for Unix soon.

Barrett said once that happens the agency would consider using the Iron Mountain service to back up data from SBA's Unix-based Web application servers.