Tabcorp bets on infosec revamp

Tabcorp is midway through a three-year security overhaul to tighten compliance and access management.

The security team at the gaming giant is a small one: five members, plus outsourcers, but they shoulder a lot of responsibility.

They are charge with securing the technology environments for two $3 billion companies, Tabcorp, which offers wagering, gaming and keno services, and Echo Entertainment Group, which operates Star City and Jupiters casinos.

“It’s challenging and fast paced,” Tabcorp chief security officer Troy Braban said of the job.

His team wrote security policy for Echo Entertainment, but the sophisticated camera and gaming security systems within the casinos are handled locally.

Braban took the CSO post last year after a three-year stretch as a security and privacy manager at Accenture, and earlier as an advisor on critical infrastructure security to the Federal Communications Department.

He kicked off his Tabcorp role by re-writing the company's security policy as part of the three-year project.

“I spoke to as many staff as possible and asked them what they want from us, and what they know about information security management. We received a gambit of responses on which to help shape policy”, he said.

Management policy was fused from several off-the-shelf frameworks “mixed, merged and tweaked” to suit 14 focus areas of Tabcorp.

Braban and his team will spend the next 12 to 18 months on compliance, working towards ISO 27001, and later rebuilding identity and access management architecture and broadening the use of reputational filtering for email.

"We see a range of attacks against our networks from a range of vectors; targeted hacks against applications and phishing emails. But the perimeter is well protected," he said.

Tabcorp will carve off its casino business, Echo Entertainment Group, in a massive demerger later this year. The company will hire a new security team to look after Echo but Braban will maintain CSO oversight across the two entities during the transitional period.

"We will give the new team access to everything we have, our tools and knowledge. It’s a big job.”