PSE Operator - IDG

PSE OperatorElectricity company uses the power of AppGate to secure critical systemsBackgroundPSE Operator is the Transmission System Operator for Poland,responsible for meeting the country’s domestic and cross-borderdemands for electricity. As well as managing and developing theextensive network of power transmission lines and substations acrossPoland, the company’s responsibilities also include the nationalsecurity of the electricity supply, managing cross-border connections,and operating the power market ‘balancing mechanism’, buying andselling balancing energy effectively in real-time to balance powerflows in the transmission system.The complex nature of the business means that many user groups needaccess to PSE Operator’s systems and resources: employees,electricity companies/traders, contractors, 3rd party suppliers. Toprotect the company’s mission critical systems and protect thesensitive information being handled on the electricity market, PSEOperator needed powerful yet flexible network security. The companyturned to AppGate Network Security for the solution.Page 1 of 2“The AppGate system is relativelyeasy to use but the key issue is that itis very powerful. It is possible todefine so many different profiles fordifferent people with very differentneeds. We couldn’t find any othersystem that allows us to define sucha variety of different profiles for allour different users.”RequirementsAccess control for a wide range of user groups: To provision accessfor a large number of users with diverse requirements, administratorsneeded to be able to define many individual roles quickly and easily,and have precise control over individual access rights: eg. electricitymarket players submitting bids to buy/sell electricity; employees usingor supporting central control systems; employees needing access tomail and office applications; 3rd party suppliers providing onlineremote system support and maintenance.Strong user authentication and encryption: Unauthorised access tosome areas of the network could have potentially catastrophic results:from manipulation of the energy markets to control of substationsleading to blackouts across the country. Therefore all communicationsneeded to be encrypted, and strong user authentication would berequired to protect critical systems.24/7 access: “We needed secure access 24/7”, says Tomasz Szudejko,Director for PSE Operator. “SCADA and EMS applications areworking 24 hours a day. No downtime is allowed so it is important forour employees at home or after hours to be able to log in and fix anyproblems – and to be able to do it in a secure way.”Tomasz SzudejkoDirector SCADA/EMSPSE Operator“We work very closely with theAppGate team in Sweden and havefound them to be very responsive,for instance when we have neededthem to develop additionalfunctionality. We think it’s a veryflexible, powerful and stable systemfor the professional and demandingenvironment. So we would be happyto recommend it.”SolutionPSE Operator selected the access control solution from AppGateNetwork Security as it met the full set of requirements, combiningstrong authentication, authorisation, encryption and access control inone comprehensive solution.....continued overleaf...AppGate uses breakthrough technology to deliver secure access control that outperformsthe old perimeter-based security model. AppGate's award winning productscombine an application layer firewall with device security and a VPN in one easy to useand cost effective solution, and provide full control of user access regardless of thesituation. AppGate's customers are located in countries around the globe and includeFortune 500 companies, government and defence organizations and companies in awide range of other market segments.

PSE OperatorSolution … continuedAppGate’s technology is flexible and scalable making it easy and costeffective for PSE Operator to start with a smaller installation and then addadditional servers as requirements changed. Initially one AppGate securityserver was installed but that has now been upgraded to support increasinglycomplex requirements. Two clustered Ax2 security servers provide internalaccess to key systems such as SAP and the energy market. A second clusterprovides external access for electricity market traders, and for technicalsupport personnel so they have remote access in case of emergency. A thirdcluster provides remote access for employees to access the mail server andoffice applications when working away from the office.AppGate is designed to cluster several servers together for high availability.Alternative IP addresses for the other clustered servers are automaticallydistributed to users’ machines so, in the event that the usual server isunavailable, connections are immediately routed to the good server. It isalso possible to connect two different ISPs to the clustered servers so if oneISP fails then users can still access the network through the other ISP/server.Powerful rules and roles management provides administrators with precisecontrol over which network resources each user can access and under whatcircumstances. End points can be measured so for example only corporateownedmachines can connect to particular applications. Services that theuser is not authorised to use are invisible thus making it impossible for themto see or attack other corporate assets. In addition AppGate canautomatically configure machines that have never connected to the PSEOperator network before. So if an external trader or supplier uses a differentPC, the client is provisioned and configured without having to wait for anadministrator’s input.FutureFor PSE Operator the goal now is to build a consistent environment acrossthe company and AppGate has been chosen to be the main system forcontrolling access to important systems. The company’s new award winningHQ in Warsaw features new control systems and technologies and theimmediate focus will be to integrate AppGate with this new infrastructure,as well as provisioning secure access for any remaining areas of the businessnot currently using AppGate eg. branch offices that need access to dataexchange, mail and other applications.Key benefitsPage 2 of 2• Secure encryptedcommunications endto-endas standard• Support for two-factorauthentication• Powerful and flexiblecontrols for managingprofiles for many userswith very differentneeds, and granularcontrol over whichnetwork resourceseach user can access• Secure remote accessenabling key users tohave 24/7 access tokey systems andapplications from anylocation• Flexibility andscalability ensuringeasy integration withexisting infrastructureand ability to supportbusiness needs as theychange• User friendly interfaceso users can accessapplications easily andquickly, and need littletraining and supportSweden, Gothenburg Office (HQ) • Phone: +46 (0)31 - 774 43 50Sweden, Stockholm Office • Phone: +46 (0)8 - 545 788 50UK Office • Phone: +44 (0)870 4460223US Office • Phone: +1 919 469-5066