Customer
success stories

Global Geothermal Power Producer Improves Security and Compliance and Takes Control of DailyFirewall Management Operations at 14 Global Facilities

AlgoSec Business Impact

• Automated notifications improve firewall management processes.• Visibility of firewall rules allows better management of security infrastructure.• Built-in reports provide instant proof of SOX and NERC compliance.

Background

Ormat Technologies, Inc. a world leader in the geothermal power plant sector, is committed to developing green, sustainable energy solutions. The company has installed over 2000 MW of geothermal and Recovered Energy (REG) power plants worldwide. Ormat’s global IT department manages network security and ensures compliance with SOX (Sarbanes-Oxley) regulations and NERC (North American Electric Reliability Corporation) at 14 of its power plants.

Challenge

Ormat’s firewall configurations typically need updating on a daily basis to address the changing roles and information technology requirements of Ormat’s global employees. As the department has assumed greater responsibility for regulatory compliance in addition to internal operations, firewall management has become cumbersome and costly.“With multiple managers adding and changing firewall configurations at our various locations, we had no way to review each change, see who made it, or know if a change was made at all,” explains Meir Moshka, IT Manager at Ormat. Without this information, reviewing firewall configurations against regulations and standards was difficult and time-consuming. “To stay compliant and secure, we needed better controls for firewall management, but we also had to stay responsive to the employees we serve,” says Moshka.

Solution

After evaluating several firewall management products, Ormat selected the AlgoSec Security Management solution for its ease of use, and for the superiority of its built-in SOX and NERC compliance reports. “The web user interface is easy and friendly,” comments Moshka. His team installed and tested AlgoSec themselves, in a matter of days.

Another capability that drove Ormat to select AlgoSec was its ability to create a workflow for their firewall configuration process. “Every time a change is made, the security manager receives an email describing the new configuration,” says Moshka. “The change is only made after the manager approves it.” The new process will ensure that all configuration changes are properly reviewed.

Results

Today, in addition to maintaining its network security policies more effectively, Ormat is dramatically reducing the time spent preparing for compliance audits. “Together, the firewall management process and reports keep us ready for an audit at all times. We save a great deal of audit preparation time because we already review each configuration change against the requirements on a daily basis.”

Automated compliance reporting also gives Ormat the power to demonstrate compliance to customers and prospects, as the company pursues new contracts for power plant operations in the US. “By using the built-in reports, we can instantly show we are NERC and SOX compliant. It’s a valuable proof for the plant owners.”

Moshka and his team also rely on AlgoSec’s built-in knowledgebase of best practices for firewall configuration. Additionally, they have customized the out-of-the-box functionality by defining additional risks that apply to

Ormat’s environment. With their customized risk profile in place, each firewall configuration change is evaluated against the knowledgebase to determine which configurations to improve or avoid. “Often, a change to the firewall needs to be more restrictive than we thought,” says Moshka. “AlgoSec gives us recommendations for each new change, and we minimize security risks by following them.”

Another improvement is how AlgoSec’s policy cleanup and optimization features ensure Ormat’s security policy is streamlined and easy to maintain. “Now I see exactly which policy applies to which firewall, which rules are duplicated, expired, or unused, and get recommendations on the most effective way to reorder the most used rules,” says Moshka.

With AlgoSec, Ormat has taken back control for its firewall policies and compliance requirements. “We’re managing our network security with much greater confidence,” Moshka says. “Add together the value of the time we save on a daily basis, and our improved compliance readiness, and we can clearly see that AlgoSec is delivering on our investment.”