Gardner-Webb University110 S Main StBoiling Springs, NC 28017(704) 406-4000
Gardner-Webb University8030 Arrowridge BlvdCharlotte, NC 28273(704) 941-5209
An event outside the University’s control that results in a substantial disruption of campus operations, including delivery of educational services. Examples include, but are not limited to, state of emergency, pandemic, epidemic, flood, fire, governmental order or adverse weather event.
(Rev. October 15, 2021)
Gardner-Webb University has adopted this plan to ensure the university is able to deliver secure and critical digital and technological services to its students, faculty, and staff and in the event of a catastrophic event, or a cyberattack. Catastrophic event recovery is integral to the university’s ability to continue administrative and business operations and academic delivery and support services.
In situations where services are disrupted, the goal is to resume operations as quickly as possible, minimize the loss of data since the last backup, and recover as much data as is possible.
There is presently a DellEMC VxRail system in the university’s Data Center, located in O. Max Gardner Hall on the Boiling Springs, NC campus, operating more than one hundred virtual servers and storing the data associated with them. Management software, on this system, records snapshots of all on-premise servers, including folder and file structures, so they can easily be restored in whole or in part. The server snapshots are backed up daily to a primary Data Domain appliance, housed on the Boiling Springs campus in the College of Health Sciences building. The primary Data Domain then replicates daily to a secondary Data Domain appliance in a university-owned facility fifty-five miles away in Charlotte, NC.
The power supplied to the Data Center is provided through an uninterruptible power system (UPS). When power is coming from the grid, it powers the batteries that, in turn, supply power to the servers. In the event of a power failure on the grid, university systems sense the interruption and start the diesel generator. While the generator is warming up to run at optimal power, systems are being powered by the UPS. The power is then automatically switched to the generator supply. Power supplied to the servers is not interrupted in this configuration. The generator then charges the batteries. When power is restored to the grid, the automatic switching unit switches the power back to the grid. The generator automatically shuts off. The generator and the UPS systems are tested quarterly, and a bank of batteries in the UPS is replaced with new batteries annually.
The university utilizes two Internet Service Providers (ISP’s). Spectrum serves as the primary and Level 3 as the secondary. These services are delivered to the Boiling Springs campus through two different routes. In the event of an Internet outage with the primary provider, systems failover to the secondary provider automatically using BGP protocol.
Some of the more critical servers hosted on campus and affected by an outage could include the following:
A number of servers and services are hosted in the cloud by other providers. These include the following:
In the unlikely event that the Data Center is destroyed or heavily damaged, the University would immediately undertake steps to replace hardware, secure and restore backups from the affected Data Domains. These systems are designed with the goal of minimizing loss of business data to no more than twenty-four hours. The university would also engage appropriate vendor partners to assist with restoration of services. These vendors include, but are not limited to, the following:
The university utilizes the DellEMC Data Protection system, a Sheltered Harbor certified solution (implemented October 2021) that will encrypt all data stored. This design continues the operation of a physical primary Data Domain with increased capacity in the College of Health Sciences building and a physical secondary Data Domain in Charlotte, also with increased capacity. Additionally, the system provides 16TB of cloud DR storage for the university’s more critical applications to be backed up. In the event of a catastrophic event or cyber-attack, these applications can be spun up for operations to resume while physical locations are restored. This Data Protection solution includes an Air Gap Cyber Recovery vault, that is physically isolated from unsecure networks and is not connected to the Internet or any other system with a direct connection to the Internet, thus making it as secure as reasonably possible. The vault has its own firewall and opens once daily to allow data flow in, with the goal of providing a backup of data untouched by ransomware. An additional layer of protection is provided by a Data Diode, which permits data to travel in one direction only.
The university primarily utilizes O365 applications. Therefore, email and the majority of employee data files are in the cloud.
Druva is air gapped and utilizes “data sharding” to separate physical data from metadata. Additionally, both sides of the data are encrypted. This protects against ransomware, accidental deletion, and internal threats. All data is moved securely cloud-to-cloud.
Barracuda utilizes cloud-to-cloud backup for email and OneDrive. It also provides Advanced Threat Protection (ATP) to stop phishing threats and account takeovers, which can open the door to a cyberattack, before the messages are ever delivered to end-users.
