Lacked resources for the on-call arrangement – the solution became a tailored MDR service with 24/7 preparedness
– Our shoulders used to be quite tense in the department, but now they are at a more normal level. There is a great responsibility in ensuring all the important services the municipality delivers to residents, says Espen Skarvang at Aurskog-Høland municipality.
|
– We have had full backing from the municipal management all the way. It has been absolutely crucial. Espen Skarvang at Aurskog-Høland municipality |
|
Skarvang works as Team and Professional Development Lead, ICT 2. line ICT and document center, and has the operational responsibility for IT security in the municipality in Inner Akershus with just over 17.000 residents. He says that it has been challenging in a relatively small municipality with limited resources.
– We are four people in IT operations in the municipality plus me, who works mostly administratively. Just having a minimum staffing level with an on-call arrangement to handle critical incidents on the network has been too expensive for us, Skarvang says.
In addition to having limited resources, the department felt that they lacked control over all firewall logs. They wanted to retain these further back in time in accordance with recommendations from the Norwegian National Security Authority (NSM).
– We have had full backing from the municipal management all the way, which has been absolutely crucial. We chose to go to the market to outsource this, and have worked with Netsecurity for about a year to put the new solution in place.
Skarvang says that the situation was previously a major burden for the municipality. The solution therefore became a tailored Managed Detection and Response service (MDR), which combines technical solutions with human expertise.
– We landed on an automated solution based on machine learning and artificial intelligence for handling central logs 24/7, where critical logs are handled by an external Incident Response Team that is always on duty. The service performs analyses of logs collected in the network.
This means there is always someone on standby when incidents occur.
– Regardless of what time of day an incident occurs, we now have someone working on it immediately. When the incident occurs, we can also isolate systems and shut down as soon as it is detected.
The service is basically fully automated and checks threats against databases with previously known incidents. It is only when something is flagged that the human factor comes into play to limit any damage.
– Fortunately, we have not had many critical incidents since we got the service in place, says a relieved Skarvang.
Kjellaug Johansen, who is head of ICT and the document center in the municipality, says that it was also important for them to adapt to NSM's recommendations for log storage.
|
– This significantly increases our security Kjellaug Johansen, head of ICT and the document center in Aurskog-Høland municipality. Photo: TUM Studio |
|
– In order to be able to analyze data logs over time, and meet NSM's recommendations for logging, we have included Data Lake, which safeguards our logs in a secure location. This significantly increases our security, she says.
Johansen says that they had several internal discussions to find the right balance between price and how much they should secure themselves.
– We have discussed back and forth a lot about how much we should secure ourselves in every possible way, and landed on a solution we believe provides the best cost-benefit for our needs.
– The assessments concern, among other things, the size of our municipality, and that we are not large enough to have specialist expertise in everything. At the same time, we are part of the line out to the residents, and have a responsibility to secure valuable services, such as health services, which the people in the municipality desperately need, she adds.
Lars Jørgen Andersen at Netsecurity, who is responsible for the Aurskog-Høland municipality account, says that the service includes a portal that the entire IT team in the municipality has access to.
|
- The MDR solution for Aurskog-Høland municipality has become extremely good, and frees up resources for the municipality. Lars Jørgen Andersen at Netsecurity |
|
– Everything is now up and running at the customer, and the customer has a full overview in their customer portal. The portal contains a dashboard where the department gets a full overview of any incidents, threats, and technical details, and whether these have been handled.
He says that a useful feature in the portal is the ability to generate reports.
– It is easy for the customer to generate reports and show management concretely what they get out of the investment. This confirms what actually lies behind it, and that it is more than just an expense in the budget.
He says that Netsecurity had its first meeting with the municipality over a year ago, and once the municipality reached a conclusion, the delivery went quickly and painlessly.
– After the first meeting, we put in place budget estimates and the cost picture adapted to their needs. In April this year, they made their decision, and after that it took only around three weeks to complete the delivery.
Skarvang says that the delivery was carried out in a very good way.
– It is important for us to have suppliers we trust, and I must say we feel very well taken care of by Netsecurity. In the cases where we have had questions, we have received quick and good clarifications. We have established status meetings where we review incidents, which has been very useful. It has also been easy for us to provide input, and they have been good at figuring things out together with us. It has opened up completely new possibilities for us, he states.
Andersen says that they have built up a solid customer base in the municipal market.
– There has been tremendously high demand from the municipal market, which we find very exciting. This makes it easier for us to map their needs and tailor solutions accordingly. The solution for Aurskog-Høland municipality has become extremely good, and frees up resources for them, he concludes.
Aurskog-Høland is a municipality in Viken county, with 17.390 residents and 1173 cabins as of 1. quarter of 2020. The municipality consists of many urban settlements, open valleys, forest, and water. The municipality has a rich and vibrant cultural life, and active residents. The municipality is located around the upper parts of the Halden watercourse. It borders Lillestrøm to the west, Sweden and Innlandet to the east, and Indre Østfold and Marker to the south. They have six urban settlements; Bjørkelangen, Aurskog, Løken, Hemnes, Rømskog, and Setskog, of which Bjørkelangen is the municipal center. They describe the settlements themselves as vibrant local communities
Read about Aurskog-Høland municipality.