OUTSOURCING - FOR INCREASED
SECURITY
Øystein Hop
Statkraft Energi AS NVE 2018-05-24
Outline
Why?
Key factors for the process
How outsourcing can improve control of operation
Where exactly do we expect to find the security improvements?
Why do we outsource IT infrastructure services
IT focus to deliver more business value guiding in digitalization initiatives
- IT i nfrastruc ture are “bread and butter” s ervi c es mature to outs ource
Faster deliveries of new technologies supporting business requirements
- Cloud services, security needs, new platforms
Challenging to deliver high quality services in an international company High HW investments upcoming due to lifecycle management
3
IT infrastructure needs to be an enabler for digital business opportunities
Key factors during the process
Process initiated by IT, not by corporate management Clear goals and scope defined for the sourcing initiative
Reissued the RFP when we were not satisfied with the first response Clear requirements set to vendors in the redefined RFP
High focus on information and IT security through the process Still high competence internally to control and verify
- We are still responsible for IT infrastructure deliveries!
4
Improved control of our operation
• Tools and processes for strict control of user access and privileges
• Monitoring of unwanted or abnormal behavior
• Clear on-boarding process with background check of all resources working on our systems
Access
• Dedicated delivery team with knowledge of our business
• Operation from ISO certified data- and delivery centers
• Centralized and automated configuration management Operate
• Audit trails to control deliveries and enhance operational processes
• Clear governance model and responsibility matrix
• Operational processes designed together with sourcing partner Control
Processes and controls for information security
• Employee Background Check
• On-/ Off- boarding
• NDAs, AUP
• Info Sec. Trainings
• Statkraft training
1 2 3 4
5
Pe rso nn el an dP hy sic al
Co ntro ls Ac ce ss Co ntr ols Lo gg ing
&
M on ito rin g
9 7
Security Operation Center 24x7
8 Security and
Event Logging
Session Logging
In scope Out of scope
Admin systems Process Control
• ISO certified locations
• Network separation Encrypted
lines 6 10
www.statkraft.com
THANK YOU
7
