Creos is Luxembourg’s main electricity and natural gas energy grid operator, providing and distributing energy around the state. The company is part of the Encevo Group, which also includes Enovos and Teseos. While EU laws require the unbundling of the component parts of the distribution and supply of energy, the Creos IT team serves to support the operational requirements of all parts of the Encevo Group, and its 2,000+ employees.
Next Gen Secure Web Gateway (SWG) – The foundation for SSE web and cloud inline security providing threat and data protection.
Visibility over cloud usage, including O365 instance awareness
Improved user experience through NewEdge peering
Blocking less, allowing more, with nuanced policies for DLP and security
The clock was ticking on Creos’ legacy web security technology. With the McAfee SWG coming to end-of-life, Raphaël Rose, Security Manager at Creos, wanted to take the opportunity to find significant improvements in the replacement.
“We wanted to fundamentally improve the user experience – avoiding latency issues for both remote and office-based employees, and we wanted to stop being so draconian in our blocking policies. We had next to no visibility over cloud usage with our old set up, and I knew if we could unlock better visibility we would be able to get more granular in our policy decisions which would mean we could allow more. Other crucial requirements were the ability to detect and control instances of cloud access, as we are a corporate O365 user, but needed to ensure personal accounts were not given the same permissions; and we wanted to simplify our set up to reduce maintenance time and support time for end user requests.”
We needed to simplify our architecture; get a single point of access, remove the requirement to hairpin to on-premise appliances, and ensure we had visibility and control over both cloud and web traffic.
The advantages of Netskope can be viewed in two categories, with the first being those experienced within the IT and security team. Netskope’s NG-SWG is enabling Creos to inspect and control all traffic – whether web or cloud – and apply threat protection and DLP policies to traffic inline. This has a clear advantage for Creos’ security posture.
Being cloud-native, Netskope is also helping on team resource allocation because Creos no longer has to run additional infrastructure to support remote workers; all data, and all users, are equally protected by the same infrastructure. This reduces costs as well as team resources required to maintain different setups. With all web and cloud security consolidated, the team has only to manage one client, applying one set of policies for all users.
Creos operates within a highly regulated industry and Netskope is providing invaluable audit trails to allow the organisation to prove compliance both with industry specific ‘unbundling’ requirements and broader EU data protection regulation. Creos plans to build upon this, providing even greater support to the company’s CISO, for instance by taking advantage of Netskope’s ability to support data governance with insights and audits of cloud application security compliance.
The strength of Netskope, for us, is the way it simplifies our architecture. We no longer need anything on-premise, we have a single point of access, a single client, and integrated threat and data protection. We are well on our way to SASE.
Netskope’s benefits are felt beyond the security team, in the user experience and productivity gains for employees. Raphaël Rose explains; “The control that Netskope gives me over cloud apps is absolutely key. Without the granularity it provides – both in visibility and controls – I would not be able to allow as much as I do. I used to have to block a lot more than I do now, but I can now use a range of tools (from remote browser isolation to user coaching and data protection policies) to keep the organisation safe and compliant.”
With employee traffic now being allowed more than [1] it is blocked, users are empowered to do their jobs using the online tools they require, but the advantages don’t stop there, as Roland Schoenauen explains.
“Our employees across the Encevo Group now have a seamless and consistent user experience, whether they are in the office or remote. Before, their experience was heavily dependent on location as we used separate setups to manage office and remote workers, but now everything goes through exactly the same channels. Remote workers are here to stay in our organisation and now our architecture no longer treats them as exceptions.”
Raphaël Rose explains that it is Netskope’s NewEdge infrastructure that ensures optimised performance times: “Netskope has direct peering relationships with our major technology vendors including AWS, Microsoft and Salesforce, so not only do we benefit from untangling complicated network architecture for remote workers, but even our office workers are fast-tracked to the internet or cloud app they need through these peering connections. It makes a notable difference.”
Creos’ goal is a Secure Access Service Edge (SASE) architecture, one that sees the merger of traditional WAN management and security capabilities into a unified whole – one that is built, implemented and managed using cloud- native architectures. With this in mind, the next step for Creos is Zero Trust Network Access, for which the company is assessing Netskope Private Access (NPA).
Creos turned to its trusted network security partner Snowball Technology for advice on how to proceed. Roland Schoenauen, Head of IT at Creos explains; “The team at Snowball Technology has an incredibly high level of security competence, both in technical knowledge and in areas such as policy and governance. Their recommendations are highly regarded by the team here.”