Strategic Development of Enterprise Secure Transmission Solution with Optimal Return on Invested Capital
SITUATION
Thousands of legacy scripts and applications spread across tens of thousands of hosts needed to be modified to address clear-text transmission of passwords. The company determined the transmission of identity credentials in clear text presented an unacceptable level of risk. This policy had developed as an internal security policy based upon industry best practices without consideration to the operational impact.
ACTION PLAN
- Assessed impact of re-writing existing applications to utilize a secure transmission method. Company-wide estimate was 5-7 years of development at a cost of $50 million dollars.
- Conducted feasibility studies for alternative technologies coupled with potential automated remediation methods. Identified cross-platform IPSec solution.
- Created & presented executive briefing detailing cost avoidance opportunity. Built consensus through presentation to CIO council and each plant manager.
- Negotiated enterprise (500,000 devices) agreement for IPSec solution at $3 million..
- Developed educational materials to raise awareness surrounding clear-text password issue including IPSec mitigation option.
- Deployed solution globally and remediated all affected systems in 18 months at a cost of $2 million.
RESULTS
The global roll-out of the heterogeneous IPSec solution reduced the total cost of remediation by 92% and in half the time. The solution has since been extended to address other areas deemed at risk, including the transmission of Personally Identifiable Information (PII/PCI) and continues to generate savings.
