The Solution
First, Pionen needed to understand the Department's business requirements – both the functional elements (what the solution would do) and the non-functional elements (how the solution would work with other capabilities). Working collaboratively with the Department's Security Monitoring Teams, they documented a series of use cases – an effective way to capture the functional requirements by describing the step-by-step process each user would go through to achieve a goal.
Pionen then worked through their checklist of standard non-functional requirements to determine the technical constraints, and based on this work, Pionen was confident a commercial off-the-shelf endpoint security solution would be suitable for the Department.
After assessing available products against the requirements, Pionen compiled a comprehensive compliance matrix with strengths and weaknesses, where the Department's buying team ran a competitive procurement to select from the top three identified vendor platform products. Pionen sat on the evaluation panel, which chose Tanium, a complete endpoint security and management platform.
Pionen then completed the complex design to allow security monitoring across hundreds of segmented networks including different classification levels. The design successfully met all the Department's strict governance standards (based on the Government Security Policy Framework) and was approved by the Design Authority.
In parallel with design, Pionen ran a Business Change Programme. They developed a Future Operating Model, creating and updating all operating processes and initiating training for each identified platform priority user group:
- The Security Monitoring Team responsible for providing assurance overwatch of the Department's infrastructure estate, and administration of their security tooling platforms.
- Digital engineers responsible for providing the IT infrastructure access, and support, for the platform deployment.
- Digital managers providing approval for operational decisions, where stakeholder support is vital to ensuring success in any deployment at scale across critical national infrastructure systems.
The first phase of implementation (Version 1) ran to January 2021, covering over 10,000 servers and critical systems hosted on premises and other large business applications running on Amazon Web Services (AWS). Pionen supported the Digital engineers to resolve technical challenges requiring supplier liaison and design amendment including negotiation with the Design Authority.
Version 2 is underway until December 2022 covering all the Department's AWS and Microsoft Azure services hosted endpoint systems.
