Securing Yarra Council

Yarra Council's security systems weren't in good shape. An upgrade has left it feeling safer and more able to contemplate and deliver online services to its citizens.

Not long after he started a new job, Stephen Peatling got the feeling something wasn’t quite right.

“Nearly 12 months ago, I took over the infrastructure area,” recalls Peatling, Coordinator of IS Service Delivery at Melbourne’s Yarra Council. “We had a number of systems looking after different security software. We had anti-virus, antimalware and another program for spyware.” But what Peatling didn’t have was a way to manage all three, or a way to understand if they added up to sufficient security for the council, which incorporates the iconic suburbs of Collingwood, Richmond and Fitzroy.

“Like every council, we are a target,” Peatling says. “We were getting hit from time to time and the software was not keeping pace.” That was a worry, because the council holds personal data about ratepayers.

“We take credit card payments from a lot of people and store a lot of confidential information about family and children’s services. Working in a council, we also have a wide range of information about people and their houses, and sometimes their financial situation, too: we offer financial counselling.” The reason council’s software was not doing well was that the council ran older versions of the products it owned. “The products were four or five years old. They were not at end of life and their age wasn’t a problem, but they were only being updated with new virus and malware signature downloads,” leaving the council with competent software, but not with tools that were tuned to deal with newer threats. Peatling also realised that operating multiple pieces of security software meant he lacked a single management console from which to monitor the overall state of the council’s security.

“I decided it was best to go to market and adopt one piece of software to do it all,” he says. That decision was backed by a security review conducted by consultants, which he says was done, in part, “so we had something to back up my comments.” The result was two new acquisitions. Sophos security software now resides on the Council’s desktop computers and servers, while an Ironport security appliance stands guard over its connections to the outside world.

“They protect everything that comes in,” Peatling says. “Sophos does user protection and Ironport operates at the gateway. We have a lot of people bringing in memory sticks from home and different organisations, so the desktop protection is important. And we have been impressed by Ironport.” The payoff from the new investment is twofold.

Peatling’s IT team finds it has more time and is better-informed about the threats it faces.

“We are spending less time managing multiple systems: probably five to eight hours a week,” Peatling says. “The new systems inform us of problems instead of us having to find out what is going on. For example, Sophos reports every time someone connects to the network and we can see what data they are taking away. We still do audits weekly, but most of the time we are waiting for the software to tell us something is wrong. That gives us a great sense of security and protection. The new products have given us more confidence to check that our gateway is secure.” That confidence and lower workload in the IT team has created Yarra Council’s second payoff, namely increased confidence and curiosity from its business people.

“It has given business people confidence we can do online services and monitor it, which sparks a little bit of discussion about new online services.

It also makes the end-user confident that they can come online.

“I think ratepayers are always looking to know it is safe and they can give us their credit card online.

Now we have the security that means they can do so confidently, and we have a platform we can use to deliver better services.”