|
As one of the largest computer manufacturers in the world, the company understands the importance of protecting IT investments. The personal computer has become a cornerstone of the information age, the holder of business critical information from intellectual property to business contracts, the starting point for transactions and communications among employees, customers, and suppliers. |
“With a good foundation, everything else falls in place” |
To protect that sensitive information, the company has pioneered a new approach to security, establishing a comprehensive infrastructure that includes policies and technologies, calling this approach the "Security Assured Organization". Entrust, chosen as the security foundation by the company, is the worldwide market and technology leader in digital certificate and public-key infrastructures (PKIs). Entrust solutions will secure some 80,000 of the company's employees - their personal computers, laptops, and systems.
Business Situation
As one of the companies that created the computer revolution, the company understands the power of personal computing. But with desktop and laptop computers containing some of the company's most sensitive documents - product plans, business contracts, sales figures - they also understood the need to protect those electronic assets.
Employees conduct 80% of computer system break-ins - it's the hackers who are responsible for the other 20% and get the publicity. The company recognized that security needs to control internal and external access - that firewalls need to be complemented by secure screen savers or passwords that protect information when employees roam away from their desktop or laptop computers. The company also recognized that security needed to extend to employees working remotely. Sensitive data was coming in electronically to headquarters from employees working off-site. Contracts, product design specifications, and financial information were arriving via e-mail without any protection from prying, unauthorized eyes.
Business Goal - Security Assured Organization
What the company sought was an overall security layer for the entire enterprise and for the 80,000 employees in various international locations. The security layer had to include technology that encrypted and decrypted files and data, verify the identities of people communicating, and denying access to unauthorized individuals. That layer also had to include policies and procedures that would ensure that the technology would easily integrate into an organization moving at a high rate of speed every day.
The company sought to create a "Security Assured Organization" using Entrust solutions, in which policies, practices, and technology combine to enable an enterprise to take advantage of absolute security for all electronic transactions, files, and communications. While many corporations are discussing the creation of this tamper-proof environment, this company is among the first to take sizable steps toward this goal.
As a Security Assured Organization, the company will be able to rely more on electronic methods to better integrate suppliers and customers, as well its far-flung employees. Time to decision, market responsiveness can dramatically rise and paperwork loads can disappear as contracts move and are signed electronically, pricing requests can be acted upon immediately, and sensitive documents can flow over the Internet - safe from unauthorized access.
The Solution is Chosen
After a rigorous analysis of over a dozen security products, the company chose Entrust in October 1996 as the security technology of choice. Entrust's pioneering of public-key infrastructure (PKI), provides a single security foundation , and the mechanism to administer other Entrust security solutions.
Through the PKI, Entrust enables an organization to issue and manage digital certificates - the electronic equivalent of a passport, and encryption keys. Digital certificates and encryption keys protect many types of critical applications, from e-mail to e-commerce transactions and beyond.
Deployment Details and Business Benefits
As is typical in many large corporations, a project, especially an ambitious project to "securitize" over 80,000 employees spread over many continents, requires strategic and careful planning.
The company's security department set the groundwork for corporate-wide security policies. The company created a security hierarchy that details policies, standards and procedures around what will be secured, which Entrust products to use and when, and which employees will have access to what data.
The human resources group at the company created two classifications of data. Depending on the criteria for sensitivity, encryption was either mandatory or highly recommended but optional.
"With a good foundation, everything else falls in place," said a company representative. "Without these policies written and accessible to the users, the program isn't effective."
To test the practices, policies, and technology, the company conducted a 100-employee pilot program, including engineers, administrators and other non-technical employees. The group tested secure e-mails and secure files across various hardware platforms and operating systems.
Not surprising, given how much communication is done via e-mail, the employees were enthusiastic about secure e-mail and having their desktops secure. Testing also proved that the Entrust's technology had only a minimal effect on network performance.
The company also developed an education awareness program to teach employees and remote access users the security policies, the technology, and the business advantage of using encryption.
