Lindbergh Caldeira
Cyber Security Operations Manager | SA Power Networks
As a critical infrastructure provider responsible for distributing electricity to South Australians, SA Power Networks has a duty to maintain the reliability, availability, and safety of its electricity network.
The ever-increasing reliance of our business on technology means the consequences of a cyber-attack on critical infrastructure can be severe, with significant impact on network operations, the potential for prolonged electricity supply loss to customers, and harm to business reputation.
It is therefore prudent to continuously mature the cyber security systems, processes, practices and tools that are critical in preventing, detecting, reporting and remediating cyber threats.
As part of our continuous improvement cyber program, which aims to reduce our attack surface and achieve Level 1 compliance with the Defence Industry Security Program (DISP) so we can pursue external projects we selected Airlock Digital’s application control and allowlisting solution as the best fit for our needs.
While the features of Airlock Digital’s solution met all our requirements, the most important factor was the operational impact of its ongoing use in our environment.
For example, our organisation invests in best-in-class technology, meaning that a multitude of different tools are in place within the organisation commensurate to the cyber risks being mitigated. As a result, our Security Operations Centre (SOC) team often had to use multiple tool interfaces to complete a single process for endpoint-related business-as-usual activities.
However, integration of the Airlock Digital solution with CrowdStrike’s endpoint detection and response (EDR) software enabled us to streamline our endpoint cyber security strategies and deliver a return on investment.
We also needed a security solution with transparency and efficacy that did not negatively impact the user experience. To understand how the Airlock Digital solution performed against this requirement, we conducted an evaluation in our environment. The exercise demonstrated that the solution operated seamlessly for users, allowing them to continue their work without any disruption.
After we selected the Airlock Digital solution, we entered an approximate three-month period of auditing activity on our endpoint devices to create policies that would be implemented as we moved to enforcement. During this time, we assigned our users into groups, including a cohort that had two devices: one for the corporate component of their role and one for the field element. With the Airlock Digital solution, we could create policies that supported and ensured there was no conflict between the different enforcement requirements of each device.
When we moved to enforcement across all in-scope endpoints, we implemented a range of complementary processes. These included generating forms through our IT service management platform for team members to raise issues and be directed to the Airlock Digital solution to request one-time passwords (OTPs) to use non-allowlisted applications. Users who receive passwords from our help desk can run these requested applications for a short time, while usage data is sent to the cyber security team to determine whether the application should be allowlisted for long-term use.
The addition of Trusted Installer to the Airlock Digital solution was also highly beneficial to us. This makes it easier for us to allowlist publishers, so we don't have to redo tickets multiple times, further reducing our ticket numbers and workload of our help desk agents.
With the Airlock Digital solution integrated smoothly into our cybersecurity stack, we are now looking for commonality in the legitimate, native tools and executables in our environment that malicious actors could exploit through living-off-the-land attacks. Where those tools don't have a compelling use for our server, desktop or other teams, we add them to our blocklist to reduce our attack surface and risk to our business.
So, what have we achieved with the Airlock Digital solution since its deployment to our organisation in early 2024?
Airlock Digital is now a critical element of our endpoint cyber security strategy, minimising our attack surface, lowering risk and giving us the ability to pursue external projects through our Level 1 compliance with DISP.
SA Power Networks is the sole electricity distributor for South Australia and supplies power to 1.7 million South Australians across about 900,000 homes and business. Its primary role is to build, maintain and upgrade a 90,000-kilometre distribution network.
.