Downer tightens IT controls as contract conditions put greater emphasis on security

Facts

Downer has increased its investment in security in response to growing contractual expectations. The company has strengthened application control measures and reduced privileged access within its environments.

Analysis

• Risk reduction: Strengthening application control and enforcing privilege limitation are established measures to decrease an organisation’s attack surface and to constrain the blast radius if an account is compromised.
• Contract compliance: As clients and partners attach more stringent security conditions to contracts, purchasers of services are likely to require demonstrable controls. Adopting stronger controls can support compliance with contractual clauses and supplier assurance processes.
• Operational impacts: Implementing tighter application whitelisting and least-privilege models typically requires changes to change management, provisioning processes and support workflows. Organisations should expect additional governance and oversight during adoption.
• Market positioning: Firms that document and operationalise robust controls may be better placed when bidding for work that contains specific security requirements, as they can provide evidence of technical and administrative safeguards.

Source material: iTnews. This article is an original summary and commentary by CEO Talk Network.