Tripwire is best known for delivering industry-leading security solutions within enterprise IT, but did you know Tripwire is an established leader in OT environments as well? There’s more need for OT security now than ever, with energy production and distribution systems experiencing an increasing risk of cyberattack as they become remotely accessible via standard internet protocols. The energy sector is one of the 16 critical infrastructure industries urged by the government to strengthen its protections against physical or cyberattack.
All energy companies have compliance requirements, but none is more demanding than the standard for bulk electric power transmission. Passing NERC audits can be extremely time-consuming, repetitive and manual. Tripwire is a proven leader in NERC CIP compliance with the NERC Solution Suite. The suite is a tailored combination of standard Tripwire products plus NERC-specific extensions. Tripwire’s library of 1,600 policies helps organizations and agencies automate their compliance tasks.
In this anonymous double case study, we explore how two major energy companies have come to rely on Tripwire as their partner in cybersecurity and compliance
Customer Spotlight #1: $12B Energy Company
Customer Since 2008
Solutions: Tripwire Enterprise
BUSINESS CHALLENGES
This multibillion-dollar energy company was in the process of moving its corporate IT environment to an outsourcer. It also lacked resources on its internal team as the company had been struggling to hire skilled security talent. Meanwhile, the company understood that this “onshoring” strategy meant losing some control and visibility. It needed a solution that would provide:
- Visibility into any unauthorized changes being made by the outsourcer
- The ability to quickly roll back any changes—including areas that could impact SLA
Overall, the company was searching for a solution provider that could act as an extension of its internal team to assist in managing its environment.
TRIPWIRE SOLUTION
More than 5,000 assets were addressed with Tripwire Enterprise along with an extremely aggressive deployment schedule and a tight deadline to meet. In a multi-million dollar deal, the company chose Tripwire as its trusted solution provider that could keep its environment performing at its best while lowering its administrative overhead for the project. Additionally, the company signed on two full-time resident engineers on a one-year, renewable contract through Tripwire’s Professional Services.
OUTCOMES
Tripwire enabled this company to deploy its in-house resources on other projects that require direct attention. As a result, the company is considering expanding coverage to other areas of its OT and non-outsourced IT assets, as well as additional engineering assistance.
Customer Spotlight #2: Fortune 250 Energy Company
Customer Since 2016
Solutions: Tripwire Enterprise, Tripwire IP360
BUSINESS CHALLENGES
For security configuration management (SCM) and baselining, this energy company’s previous solution was too cumbersome to manage. It was not scalable and did not deliver on the automation capabilities that were originally promised. The process was too manual and the solution required a lot of “care and feeding.”
For vulnerability management and asset discovery, there were difficulties with scanning highly sensitive control systems using a cloud-based solution that had negative consequences to the control systems. The existing reporting tool was also difficult to use; there was too much data and not enough prioritization.
TRIPWIRE SOLUTION
Following a challenging NERC CIP audit, this energy company determined that it needed an automated, industry-standard solution to reduce compliance risk and manual efforts. After considering expanding its investment into its legacy tools, the company decided to transition to Tripwire for 1,000+ NERC CIP Assets and 2,000 IP addresses for monthly configuration baseline of the assets for NERC CIP-010 R2 and R2, as well as doing a discovery for unauthorized changes. Tripwire offered a holistic, scalable and easy-to-use solution that was automated and had deep FIM capabilities. Furthermore, Tripwire IP360 provided granular detail in reports, including heat mapping and risk prioritization.
OUTCOMES
In addition to the added automation capabilities, this company’s time is now better spent analyzing its data rather than manual efforts required by its previous solution. Tripwire’s integration capabilities made it easy for this company to not only fully integrate Tripwire Enterprise and Tripwire IP360 but also its other existing security hardware and software. With Tripwire, this energy company can build enterprise scalability beyond Industrial Control Systems and has the ability to cover both IT and OT environments with a single solution.
Need Help Finding a Cybersecurity Solution?
Contact one of our product experts to find a solution that meets your security needs and reduces your business risk. Whether you have one or several initiatives to respond to, Tripwire ensures compliance, security, and flexible risk management solutions.