St. Antonius Hospital Secures Patient Data with Commvault Cloud Air Gap Protect 

St. Antonius Hospital Quickly Mitigates Log4J Vulnerability with Commvault Cloud Backup 

St. Antonius Hospital rapidly deployed Commvault Cloud Air Gap Protect to address Apache Log4J security vulnerability and enhance data protection. 

About St. Antonius Hospital 

St. Antonius is a major hospital in the Utrecht region of the Netherlands, specializing in treating heart and lung diseases and cancer. It is part of Santeon, a group of seven collaborating top clinical hospitals in the Netherlands. 

St. Antonius has three main locations, five external outpatient clinics, around 600 beds, and 7,000 employees. With this scale of operations, the hospital holds terabytes of sensitive patient and business data that it needs to protect and back up efficiently. 

Increasing Security of Privacy-sensitive Data

In late 2021, news broke about a security vulnerability in Apache Log4J, which could allow cybercriminals to access servers, applications, and data via this widely used log library. Although St. Antonius didn’t face an immediate threat, the hospital decided it needed to rapidly implement an additional backup provision for all data in its IT systems. 

“Most of the data we use is very privacy-sensitive. For example, it involves patient information that we are extremely careful to protect,” said Cindy Cusell, Network & System Administration Team Leader, St. Antonius. 

“There are also business-critical applications that use this information and are part of the care process. Naturally, we want to prevent disruption of this process because the data is not available as a result of a hack. The continuity of care is always paramount. We therefore always do everything we can to facilitate and secure this.” 

Introducing Fast and Easy Total Protection Against All Would-be Threats 

Together with its IT partner, AnylinQ, St. Antonius compared several possible solutions. Due to the potential threat of the Log4J leak, this occurred under considerable time pressure. “We were looking for a solution that we could implement quickly and easily, and that was easy to use,” Cusell said. Due to Christmas, reduced staffing in the hospital’s IT department posed an additional challenge. 

St. Antonius quickly concluded that cloud backup via Commvault Cloud Air Gap Protect was the best fit. “Of course, we looked at alternatives, but we could implement Commvault Cloud Air Gap Protect within a few days,” said Krijn Koster, Technical ICT Architect, St. Antonius. “It connects seamlessly with the Commvault backup environment that we have been running locally since 2016 in combination with storage from Hitachi. This was the deciding factor for us.” At the time, St. Antonius chose this local backup facility because it best matched the technical management of a new Electronic Health Record system it had recently introduced. 

“In two days, we determined the solution and discussed all the technical issues. For example, we had to set up a few connections to communicate with the Commvault cloud. Finally, within three days, we started writing the backup to the cloud,” Koster said. 

Quickly Mitigate Immutable Back Up To Cloud, Easy of Scalability 

The backup process was constrained only by available Internet bandwidth and the performance of the deduplication database. That application flags duplicate data blocks, ensuring that no duplicates end up in the backup to accelerate the data transfer speed and reduce storage costs. “That’s not surprising because it involves a lot of terabytes,” Koster said. 

Commvault Cloud Air Gap Protect allows easy usage scaling, which appealed to Cusell and Koster. “We started with 30 terabytes, but didn’t know exactly how much data we would eventually have to process. The ease with which you can scale up and down makes Commvault Cloud Air Gap Protect an attractive solution. You just start small and scale up as soon as you need to,” Cusell said. 

Cusell said it helped that St. Antonius had been working with a Commvault Cloud Autonomous Recovery environment for some time. “We had to make do with a limited number of people who were working around the holidays. Because they were already familiar with the Commvault environment, we were able to execute this project without a significant additional management burden. It’s the same tooling that the administrators were already using.” 

St. Antonius had recently revamped its Commvault Cloud Autonomous Recovery, so there was virtually no need to modify the architecture for the Commvault Cloud Air Gap Protect expansion. “With the choices made at the time, we can now easily write an additional copy to the cloud,” Cusell said. 

An important feature of Commvault Cloud Air Gap Protect for the hospital is temporarily blocking modifications to backed-up data. This immutability means the data can’t be modified or deleted until a preset retention period has passed. This is useful when backing up data that is subject to a legally binding retention period, such as medical and personal data. 

Service provider AnylinQ played an active role in the Commvault Cloud Air Gap Protect project, insists Cusell. “We were in constant contact with their specialists. They were always working at the forefront. For example, they provided our license and helped with the implementation, testing, fine-tuning, post-testing, and optimization.” 

Looking back, Cusell and Koster are highly satisfied with the choice of Commvault Cloud Air Gap Protect as a platform for additional cloud backup. “It matched our needs well,” Cusell said. “We wanted to quickly mitigate the risk of the Log4J leak. The ease of implementation if you already have a Commvault environment was decisive for us. It barely added any work. The implementation week was busy, but after that, it ran smoothly.”