Developing An Internet Services Security Strategy

Background

Of all the organisations that require secure IT systems for their survival, few are more dependent on technology than modern local authorities.  Virtually every area of a council's activity, from collecting local taxes through to housing benefit, social services and payroll, requires mission critical applications running in a highly secure infrastructure.

Through Sopra Group's existing relationship with East Lothian Council, working on projects as diverse as content management system selection and business process reengineering, Sopra Group was asked to provide consulting services that would allow the council to deploy Internet based services in a secure manner.

The initial systems considered for deployment were a public facing library system and an Intranet service that could be accessed securely via the Internet.  Also included within the scope of the project was an investigation into the security implications of deploying council wide citizen authentication solutions to allow for single sign on to all Internet deployed council systems.

Solution

The project took six months to complete and allowed Sopra Group to guide the client though the process of defining a strategy for securely deploying all Internet services current and planned.  In order to ensure that the council was able to gain best value for money with regard to these systems Sopra Group worked with the council to develop a process of identifying:

• The business case for deploying the system
• The risks associated with the system deployment
• Risk mitigation techniques capable of removing these risks
• All cost elements associated with the deployment of the particular risk mitigation techniques including:
  • Training
  • Staff resources
  • Internal & external service level agreements
  • Testing strategies
  • Audit trail retention

Benefits

Sopra Group has worked with East Lothian Council for a number of years and is recognised as a trusted partner.  The successful implementation of this project has delivered a series of key benefits for the council.

These include:

A risk based strategy that allows them to deploy the current systems as well as a template that allows for:

• Assessment of supplier solution information
• Identification of system deployment issues on all aspects of the council IT staff including such elements as user administration time, system backups and disaster recovery that are traditionally not costed into solutions prior to purchase
• A clear matrix matching business benefits to risks, risk mitigation costs and acceptable business risk
• A clear view of the implications of single sign on so this can be deployed at the right time for both the citizens and the council

"Sopra Group has not only given us enormous help in assessing the security issues surrounding these two systems but has given us an approach that will enable us to implement future systems at a consistently secure level."

Gordon Stephen,
Programme Manager, East Lothian Council