THE CITY OF BOROONDARA is called the ‘City of Harmony’, but the word harmony did not describe its IT systems in 2005. The City of Boroondara is a local government council in the eastern suburbs of Melbourne, Victoria. It formed in 1994 with the merger of three cities, Kew, Hawthorn and Camberwell, and has a population of more than 160,000 people.
Boroondara Council had reasonably complex IT systems consisting of 34 sites to maintain. Scattered amongst those 34 sites were 24 different departments doing 24 different things, like maternal and child health, meals on wheels, libraries, environmental health, community care and aged care.
Lesley Milburn, manager information systems for the City of Boroondara Council, says the main problem was multiple systems operating IT security. “We had MIMEsweeper, SurfControl, proxy servers, firewalls and a number of things that in themselves weren’t large tasks, but together were a considerable amount of work.”
Milburn says there were a lot of security tasks the council was not particularly good at monitoring, and security tended to be left to one side until something happened. She knew IT security had to have an overhaul.
The pitch
Milburn sought help following a time when the council had experienced numerous issues with viruses and had been grappling to get time even to check the logs of its intrusion detection device.
Systems integrator Southern Cross Computer Systems (SCCS) and managed security services provider Network Box came up with a solution for Milburn that provided 24-hour, seven days a week security.
That was the first clincher for her – “because we didn’t have someone here all that time, and even when they were here, five days a week, we still didn’t have that kind of coverage,” she says. “So what captured me was the 24x7 security, and that it would cover multiple systems – not just intrusion detection or firewall or virus protection or surf control. It was going to do everything.”
She says the technology partners took much more of a business-needs approach, rather than just focusing on the technology needs, and the economic benefits sold her as well.
National professional services manager for integrator SCCS, Steven-Meyer Cohen, says the reasons the IT security implementation for Boroondara went so well is because SCCS knew the customer. “We knew their IT environment and we did the requirements analysis with them. With any IT project if you do the planning and hard yards up front, you’ve got less chance of it coming unstuck later on,” he says.
| BOROONDARA'S ISSUES |
|
The process
Between November and December 2005 Boroondara Council installed a Network Box integrated security appliance at its two main sites to replace the previous point devices.
One device was installed at the council’s prime site at Camberwell, and another device was installed at the council’s secondary site at Hawthorn. Hawthorn was designated as the disaster recovery site, “ensuring coverage at all times and providing a fail-over for the council”, Milburn says.
A staged approach was adopted for the migration from old systems to the Network Box infrastructure.
“It wasn’t all one big hit,” Milburn says. “We started with easier things like virus protection, the proxy server, until we got comfortable with the first few phases. Then we got to the harder ones like SurfControl and MIMEsweeper,” she says.
Milburn says by end of March 2006, the following components had been activated: firewall, proxy server, radius, web content filtering, email content filtering and anti-virus.
The council’s technical services team leader, Jim Papazoglou, says five or six old applications have been amalgamated into the Network Box. “At the moment we’ve only got one component of MIMEsweeper, which we’re still managing, but we’re actually phasing that out onto the Network Box as well,” he says.
Keith Glennan, managing director of Network Box Australia, says Boroondara Council was not a trivial implementation. “There’s a lot of stuff we do for them. They’re actually a reasonably complex network, over 34 sites,” he says.
Despite this, there were few hiccoughs he says. “There’s not a lot our guys haven’t seen now,” Glennan says. Papazoglou says one snag in the process was a “tunnelling” issue.
 |
| Boroondara's Papazoglou: Old apps amalgamated into Network Box appliance |
“We needed to create an encrypted VPN tunnel between our organisation and our library catalogue system, which is hosted offsite,” he says. “Although in the beginning Network Box didn’t understand the tunnelling protocol we used to the library system, they were quick to figure it out and propose a better solution.”
He says in the end, Network Box devised a superior method of tunnelling. “Even the vendor, who we tunnelled to, was quite happy with the outcome, and how Network Box worked through to get a better solution,” he says.
SCCS’ Cohen says one of the challenges in any integration project is to know your own limits. “We’re a mid-tier systems integrator with 40 people in the group, but we don’t run a 24x7 monitoring facility. Unless you’re living and breathing security all the time, I just don’t think you can provide the highest level of service that customers demand nowadays.”
Cohen says partnering with Network Box made sense for both SCCS and the council. “While we certainly have the nous to do the requirements analysis, and the nous to do the implementation, Network Box’s forte is that they have the economies of scale to do the 24x7 monitoring and support. And that’s what customers demand nowadays and this is a cost-effective way for us to be in the market and delivering it, without setting up our own network operations centre.”
The results
Milburn says it is probably an oxymoron to put ‘IT’ and ‘painless implementation’ in the one sentence. “But it was amazingly uneventful, and the benefits flowed straight away,” she says.
There were tangible economic benefits. “We worked out how much we used to pay for hardware, maintenance, and the staff and resources required to manage and monitor it. With the new solution, the payback was almost within the first two months,” Milburn says.
Equally as important as ROI was reduction in security risks. Two years ago, the council had three days of ‘outage’ because the servers were hit by a virus. “If you work out the costs of that, the payback now is almost a no-brainer,” she says. “We’ve saved on resources, we’ve saved on the cost of hardware, and we’ve saved on the cost of maintenance.”
Other councils have since approached Milburn to see if they can replicate the transformation in their IT security systems.
One of the primary benefi ts Papazoglou noticed was the constant security updating and patching. “It wasn’t our core focus [before] so it was difficult to keep on top of the latest [threats]. Network Box gives us a level of comfort that they are constantly updating for viruses and security hacks.”
 |
| SCCS' Cohen: Customers demand 24x7 monitoring |
SCCS’ Cohen says the council has also saved money by consolidating and not having to pay separate licensing for every individual product. “They don’t have to check the logs every day either and make sure they’re updated. Network Box does that for them,” he says.
Soon after implementing Network Box, the company alerted the council that someone with a wireless computer was trying to break into the network. That person’s network access was blocked and he was quickly identified as an external vendor and contacted and briefed about the “inappropriate network access”. Boroondara Council has since found that increased awareness of this capability has been an excellent deterrent for others trying to use the network inappropriately.
Improved employee productivity has been another side benefit of the council’s upgraded IT security. Milburn says the council had not been blocking a lot of websites because it just did not have the resources. “We stopped some of them but we couldn’t stop them all and they just developed every day. Some staff couldn’t understand why we blocked certain sites, such as gambling sites. Now staff aren’t able to goof off on gambling sites or search sex sites. They’re much more productive now,” she says.
In the public’s dealings with council, Papazoglou says the public is now aware that council has experts managing its security and constituents are more comfortable that their privacy and data is more secure.
Papazoglou says the council is also much better prepared in the disaster recovery stakes, and continues to do more work with its IT partners in this area. “We previously had four or five applications which we were contemplating mirroring the hardware, the licensing and everything to our remote site. But with the Network Box solution, we’ve been able to put two Network Boxes – one at each site – and they do load sharing. In a disaster they fail-over for each other,” he says.
Papazoglou says an important characteristic of both IT partners, Network Box and SCCS, is that they became a “good sounding board” for the council for a variety of other issues. Southern Cross Computer Systems is finding more and more companies needing help with complex IT security services including threat management, disaster recovery.
-1.jpg&w=100&c=1&s=0)
.png&w=100&c=1&s=0)
