In-office server vs. Google Drive advice needed

[vicjm]

Long-time lurker here needing a little advice. I'm a full-time lawyer, but since I'm pretty good with computers other attorneys will sometimes ask me to help out with tech issues (the level of discomfort with technology among attorneys is pretty staggering). Anyway, networking is kind of my weak spot and I'm trying to decide on a direction to go when helping a friend of mine with his office.

He has a small operation, 2 lawyers and 2 assistants. They currently have a machine with Windows Server 2003 on it where they access all their files from their individual computers. I'm setting them up with Google Apps so they have a better shared access calendaring system and access to documents from mobile devices (for reading primarily, not editing). Here are what I'm considering as the two options:

1. Keep the server and continue having the office use a folder on that machine as the central file storage location. I would set up Google Drive to sync with that folder so they can access those files from anything with a browser.

    GDrive
        |
    Server
   /  |  | \
  PC PC PC PC

or
2. Dump the server and just use Google Drive as the central file storage location. I would then set up a folder on each machine to sync with Google Drive. Then even if they lose internet for a while, each machine should have an identical synced folder to keep working with, and which will resync when they reconnect.

    GDrive
   /  |  | \
  PC PC PC PC

I hope you appreciate my valiant effort at forum post diagramming.

Anyway, the benefit to option 2 is then I don't have to mess with any network configuration issues, I just need to get each PC connected to the internet. I'm also not worried about storage security issues, as I'm sure the stuff would be at least as secure on Google's servers as it would be on anything I set up in their office. Can you see any holes in my plan or any other options I've overlooked? Thanks for any advice.

 

[kevnich2]

Not minding the whole security/privacy with cloud based storage issue - The only possible issue I see with option 2 is if somehow google deletes all the files in there, taking the other synced ones with it. I would definitely recommend having a program sync/backup the google drive to a local folder/drive every few days or a week just to be on the safe side.

Other than that, if they are fine using google drive, I don't see the need for a dedicated file server for 4 user's. That does depend entirely if the server is only used for file serving or if it also has other uses as well. Do they store any large files (>500mb) or is it mostly word docs and the like?

 

[vicjm]

Not minding the whole security/privacy with cloud based storage issue - The only possible issue I see with option 2 is if somehow google deletes all the files in there, taking the other synced ones with it. I would definitely recommend having a program sync/backup the google drive to a local folder/drive every few days or a week just to be on the safe side.

Other than that, if they are fine using google drive, I don't see the need for a dedicated file server for 4 user's. That does depend entirely if the server is only used for file serving or if it also has other uses as well. Do they store any large files (>500mb) or is it mostly word docs and the like?

Yes, I would definitely be setting up an backup system to keep a local backup of all the files (probably something involving rotating out multiple flash drives). The storage is almost entirely documentation. In fact, I think they might actually use less than 2gb of storage because I considered just going with a free Dropbox account for the same functionality. Non-techie lawyers are always surprised when I tell them that I can fit all their work over the past 20 years onto a thumbdrive and only use about 10% of the space.

Thanks for the thoughts on the server. As I said, servers and networking aren't my strong suit so I wasn't sure if there was some benefit I'm missing. Would I be correct in assuming that the benefits of a server really kick in when you're talking about more users?

 

[Emulex]

google can go offline for X hours, what is your maximum acceptable downtime before you start to lose money?

to most people that is zero.

distributing your files across local and remote is a good way to achieve zero (but it is never a replacement for backups!)

 

[kevnich2]

A server use depends entirely on the business model, how many computers are in use, the use of the computers and how much manageability you want to have. If you're a typical business with more than 10 computers in one central location, it makes sense to have a server for both storing files, backups as well as being able to maintain settings and user accounts across all the systems with ease.

In your setting, which I have seen with many attorney's offices before, considering that they are generally on the lower tech side of things, they like using cloud storage simply because all they need is an internet connection and they have all their files no matter where they're located at.

 

[kevnich2]

google can go offline for X hours, what is your maximum acceptable downtime before you start to lose money?

to most people that is zero.

distributing your files across local and remote is a good way to achieve zero (but it is never a replacement for backups!)

I don't see how google drive going offline for several hours would really affect much as if you install the program, it's like dropbox. It keeps the files synced on your computer and as soon as either your internet comes back up or the service comes back up, the files re-sync themselves and your good to go. I do wish cloud storage services came with more encrypted type security. Like an option when you install it to use your own encryption key and all files stored in the cloud are encrypted with it, so you still get full benefit of cloud storage/backup and sync to many devices but your data is securely stored.

 

[Kremlar]

How does Google Drive handle simultaneous file access? What if 2 attorneys modify the same spreadsheet or document at the same time?

 

[drebo]

Except for a very small office, I would not recommend using google drive except as a backup (and even then, only combined with a good local backup.)

Basic entry-level servers (with a RAID 1 and Windows Server 2012 Foundation or Essentials) are extremely cheap now and easy to set up. There are many benefits to running an AD domain, aside from just file storage.

 

[dave_the_nerd]

How does Google Drive handle simultaneous file access? What if 2 attorneys modify the same spreadsheet or document at the same time?

They see each other working. It's kinda neat.

 

[Kremlar]

They see each other working. It's kinda neat.

That's with Google DRIVE (using Word/Excel) or Google DOCS?

 

[dave_the_nerd]

That's with Google DRIVE (using Word/Excel) or Google DOCS?

Oh, Docs. nm.

I don't know how Drive handles files that are updated by two people at the same time. I suspect it'll overwrite. Which is bad.

(Paid) services like Egnyte do cloud-based storage, and offer file-locking and/or checkout features. (Sorry Ralph, you can't open this file, Sarah is modifying it.)

http://www.egnyte.com/file-server/online-file-server-features.html

 

[Kremlar]

That's the biggest hiccup I see with small firms moving to free/cheap cloud services with no ability to lock files. Most firms can't have overwrite or even double file issues.

 

[apmon]

Not minding the whole security/privacy with cloud based storage issue

Well, privacy is a pretty big thing to mind as a lawyer! I am not sure I would trust a lawyer who puts all of their documents unencrypted into the cloud!

So I would strongly recommend to encrypt everything before pushing it into the cloud, or keep things completely local.

 

[Mushkins]

Well, privacy is a pretty big thing to mind as a lawyer! I am not sure I would trust a lawyer who puts all of their documents unencrypted into the cloud!

So I would strongly recommend to encrypt everything before pushing it into the cloud, or keep things completely local.

This, 100% this.

It's a law firm, you can't just ignore the privacy issues and do whatever, they are a fundamental part to the answer of this question.

Local server with secure, encrypted cloud backup *is* the answer in a situation like this. There are all sorts of laws and regulations a law firm needs to be in compliance with when it comes to client information. You're talking protected personal information, HIPAA/SOX protected information, all sorts of stuff. You can't just be uploading that unencrypted to a google drive, it's flat out illegal. The size of the firm doesnt matter, do right by your clients and do it right the first time.

 

[Genx87]

I am not familiar with the privacy laws\regulations with client data. I would check into that before using an online solution. Make sure it is compliant with those laws and regulations.

 

[kevnich2]

This, 100% this.

It's a law firm, you can't just ignore the privacy issues and do whatever, they are a fundamental part to the answer of this question.

Local server with secure, encrypted cloud backup *is* the answer in a situation like this. There are all sorts of laws and regulations a law firm needs to be in compliance with when it comes to client information. You're talking protected personal information, HIPAA/SOX protected information, all sorts of stuff. You can't just be uploading that unencrypted to a google drive, it's flat out illegal. The size of the firm doesnt matter, do right by your clients and do it right the first time.

How about before we go ranting and raving regarding a law firm using cloud services such as google drive or dropbox, how about we do some research first. Also, a law firm has nothing to do with HIPAA and I fail to see how SOX compliance would have anything to do with this either? See the article below, it references dropbox but I don't see the difference between the two.

http://www.securityblawg.com/2012/08/dropbox-for-lawyers.html

Edit: I am in no way supporting the use of this by a law firm at all but a law firm is under different laws than say a healthcare provider which I know personally dropbox and google drive are NOT hipaa compliant but a law firm isn't bound by HIPAA.

 

[kevnich2]

Another option that may be up for consideration is spideroak. I'm actually looking at this myself to see if it's as seamless of a sync as dropbox is. I'm not a fan of dropbox's and google drive's privacy policy and lack of encryption. I love cloud storage and syncing but I also like having my data encrypted.

 

[JackMDS]

In many cases an office of 4 people with computers can benefit from small server.

Howvevr, I can not make the judgment for you on this topic if you can't.

Only thing that I would say is, there must be something (even a large USB Flash drive) to provide self controlled countable back up to be always available regardless of the status of Google.

I would not risk my lively hood on any of the consumer Internet consumer solution.

 

[Mushkins]

How about before we go ranting and raving regarding a law firm using cloud services such as google drive or dropbox, how about we do some research first. Also, a law firm has nothing to do with HIPAA and I fail to see how SOX compliance would have anything to do with this either? See the article below, it references dropbox but I don't see the difference between the two.

http://www.securityblawg.com/2012/08/dropbox-for-lawyers.html

Edit: I am in no way supporting the use of this by a law firm at all but a law firm is under different laws than say a healthcare provider which I know personally dropbox and google drive are NOT hipaa compliant but a law firm isn't bound by HIPAA.

Law firms absolutely have to stay HIPAA/HITECH compliant with any and all information they may have under the "business associate" clause, just like any other covered business associate. Someones suing someone else to pay for their medical bills? A good part of that protected medical information is going to be handled by those lawyers including care records, insurance claims, and protected health information. Those lawyers are legally bound to properly protect that information. Likewise, these may be lawyers *representing* medical professionals in malpractice suits.

SOX was just an example of a legal regulation dictating potentially protected client documentation. We don't know what kind of cases these laywers handle and what kind of information they may be dealing with that's legally protected in some way because the OP didnt specify.

What we do know is that legal regulations and information handling best practices both dictate that you don't upload sensitive client information unencrypted to a service like Dropbox. The OP isn't talking about sharing office memos about where to go to lunch, he's specifically asking if he can use a service like this to replace a traditional fileserver for their firm, to which the answer is a firm "not if you want to properly and securely handle your data."