OVERVIEW

With 215 establishments benefiting from their services, the Health Cooperation Group (GCS) Télésante Lorraine, was chosen by the Regional Health Agency (ARS) Grand Est to develop e-health in the region. The company has more than 120 ships, 5,000 tank containers and 21 terminals. Six business units fall under the umbrella organization Stolt-Nielsen Limited (SNL) and three business units are represented in the Netherlands: Stolt Tankers, Stolthaven Terminals, and Stolt Tank Containers. Because SNL works with hazardous substances, security has always been important. With the connection of the vessels to the corporate network, new challenges arose. To protect the OT networks (ICS / SCADA) on the ships against malicious code and attacks, SNL uses Trend Micro TippingPoint. In addition, the company has outsourced the security operations center (SOC). Part of the security services in the SOC consists of cloud workloads which are protected by Trend Micro Deep Security.

WHY TREND

Sloof and his team determined the specific requirements, “We have assumed network security. We have had to be ‘agentless’ and required 24/7 global support, from a globally operating vendor for whom intrusion prevention systems solutions (IPS) was also an important part of the portfolio. Moreover, we did not want a vendor lock-in and we were looking for a solution that works with all underlying servers. Gartner™ mentions three to four players in their Magic Quadrant. Once we determined our vendor requirements and criteria, we compared these parties and entered into a discussion. Trend Micro TippingPoint quickly emerged as the winner,“ he says.

SOLUTION

After several meetings on different designs and a successful Proof of Value (PoV), Stolt-Nielsen decided to implement Trend Micro™ TippingPoint™ 2200T in its data centers. This filters all the network traffic, looking for any harmful code that can get to the ships. “After the choice was made, we immediately started a pilot, and a number of ships were connected. For this, we only had to adjust the IP routing. Perhaps the best thing about the process is that we have invited a TippingPoint expert and a hacker at the same time to see if and how Trend Micro TippingPoint could ward off the hacker. As soon as the hacker started an attack, you saw that come up in the control panel. That was very educational and entertaining at the same time“.

Sloof explains how Trend Micro TippingPoint protects the OT/SCADA networks of SNL. “All data must go through the data center. Trend Micro TippingPoint views this traffic, recognizes data patterns, and checks whether they meet the characteristics that they should. So if a system normally only communicates with ‘the neighbor’ and then contacts other external devices, it indicates that something is wrong. As soon as there are deviations, a notification will appear. You can choose between the ‘detect and report’ mode or you can block the threat immediately and then report it. In the beginning we also did not know internally why a report came in. The experts at Trend Micro were able to explain why something is seen as a threat by the system”.

It soon became clear to SNL that Trend Micro TippingPoint met their expectations and the system was fully rolled out. “The IT service provider has actually implemented Trend Micro TippingPoint 2200T. Then the experts from Trend Micro started working on the configuration of the system. That all went very smoothly,” says Sloof.

Because all security events are monitored individually, and because there was no time and space within the IT management team to make connections, SNL started looking for a solution that would in fact make these connections. Says Sloof, “That is specialist work, so we consciously choose not to build this knowledge ourselves. That is why we have outsourced our Security Operating Center (SOC) to Tata Consultancy Services (TCS). Part of these security services is Hybrid Cloud Security - mainly for Microsoft® Azure® workloads - that is based on Trend Micro™ Deep Security™ solution.

RESULTS

Between making the decision and putting Trend Micro TippingPoint into production, there was a period of one and a half to two months where a total of 103 ships are connected. “We have identified a number of risks since the connection. In one system—where no virus scanner is allowed to run—there were 40 viruses. All events are now stopped with Trend Micro TippingPoint. Naturally, the necessary virus scanners are also running. At the same time, the new system also creates new challenges because everything that was not visible before is now visible. We are 80 IT staff, half of whom are in charge of management. The IT world is becoming increasingly complex and more threats are being added. It is therefore impossible for us to correlate all those threats at different levels, while this is really necessary,“ explains Sloof.

“The reports that Trend Micro TippingPoint gives are fairly rigid. The moment the system does not recognize things, they are classified as undesirable. If the activity is known, then nothing is wrong. Trend Micro Deep Security is integrated into our SOC to be able to add a shade of gray to all events that we come across. This system reads in all events and then the link between these events is made by a person. Then the event goes to ‘deep inspection’, after which it becomes clear whether it is ‘good or evil’”.

WHAT'S NEXT

Developments in the shipping industry evolve extremely fast. Technology plays a driving role in this. “We think innovation is very important, but only if we don‘t have to add water to the wine in terms of safety”, says Sloof. “We are therefore pleased that we have found in Trend Micro a party that has a lot of experience in our sector and develops solutions that are safe, intuitive, and future-proof. This allows us to focus our attention on the core business and on our customers“.