Case Study by Nicole Anderson - Business Support Services Manager, Dunbrae
The Background
Dunbrae comprises several companies that specialise in facilities management and equipment maintenance. To meet the needs of our clients across Australia, we maintain a large workforce and have offices in most states.
Information security is extremely important to us. We need to protect our clients and suppliers, as well as our staff. While the information we share with clients and suppliers is generally in the public domain, our employees' personal information is sacred and must be protected as such. Yet with such a large workforce, we know we run the risk of it being accessed and stolen. We can't let that happen.
The Goal
Recently, our executive management team decided to renew its focus on information technology and review and upgrade our security.
Our executive management team wanted to align our organisation with the Australian Signals Directorate Essential Eight (ASD8). This was something that we had been working towards within the capacity of our resources and budget, but we knew we had some way to go.
We determined that we needed to bring in external advice to reach full maturity with speed and efficiency. We required a complete review of our infrastructure security to identify the gaps, plan the fixes and put the necessary tools in place. With limited IT expertise in-house, there was no way we could do it alone.
The Selection
The Missing Link was the obvious partner for the project. We'd been working with them for a number of years – since the early days when we were working from internal servers. In 2014, they migrated our business to the cloud, and since then, they've been our cloud infrastructure gurus, helping us with everything from sourcing software and managing licenses to troubleshooting.
As soon as I'd spoken to them about our plan to conduct a Security Controls Review, they were on board. We have such a close relationship, and they have such a strong understanding of how we operate our business that we barely had to discuss the project with them. They knew what we needed and got straight to work.
The Relationship
As with every project, The Missing Link has been great. I know a little bit about IT, having absorbed information along the way, but I'm no expert, and they're happy to do whatever it takes to make sure I understand and am comfortable with all their recommendations – even if it requires sitting me down with engineers and technicians. They're also excellent when it comes to responding to enquiries – if the account managers are not available when I call, they get back to me as soon as physically possible and, if they can't answer a question, they find someone within the organisation who can. That doesn't happen very often; the account team has such a wealth of knowledge.
Something else I appreciate about working with The Missing Link is that they're quick to escalate issues when required. Recently we had an issue with our active directory server, which meant no one could log into parts of the network to access files they needed. As soon as they were alerted and without prompting, The Missing Link escalated the issue to a P1. It was fixed before we knew it.
Impressively, when it came to managing the Security Control Review, The Missing Link was incredibly flexible. At the time, I was working on budgets, so I wanted all the financials to be included in their report - not something they'd normally do, I know. But they were happy to provide their recommendations, clearly explained and all priced up, ready for me to put forward for executive approval.
The Difference
At Dunbrae, our senior executives are strong on business knowledge - that is their focus, and we only have one in-house person with IT experience. To achieve everything we need, we have to share the load with external providers.
To do this, we rely on The Missing Link, and they're always there to help – in fact, they've never let us down. They provide the tools we need to manage and protect our infrastructure day-to-day. They also help us better communicate any proposals, issues and recommended approaches to the executive, which speeds up the approval process so we can quickly move forward.
The work we're doing to upgrade our security operations centre is in its early days, but I'm really looking forward to completion. As much as we were very cautious in setting up our security infrastructure, nothing is foolproof, so knowing we've got The Missing Link partnering with us gives us a level of comfort. With their knowledge and resources, we know that reaching ASD8 maturity is entirely achievable.
