MACMILLAN
BEAZLEYCANCER
INSURANCESUPPORT CASE STUDY

Macmillan
CancerSupportDelinea SecretServer
PAM helps
insurancecompany
Secures
admin,
third-party,
andsave months preparing
for audits
and achieve
highcomplianceserviceaccount
accesswith
Delinea scores

Challenges
Macmillan Cancer Support has been serving the people of the UK for over a hundred

Backgroundyears. Recently, the organization launched an initiative focused on protecting itself,
its employees, and the public it serves. As part of that initiative, they hired security
expert Tim O’Neill, who was tasked with building a team and maturing the security
function into a proper department.
O’Neill wasted no time getting started. “The first thing I did was hack the organization
to analyze its weaknesses,” says the company’s head of Information Security. “I found that a lot of work had been done: their policies were up to date, and they had acomprehensive training structure in place. They’d accomplished a lot, but some bestpractices were lacking.”“There was a domain administrator account called ‘administrator,’ and people didn’t
seem to realize the risk associated with that. There were 450 admin accounts andFounded in 1911, London-based
Macmillan Cancer Support is one of
the largest charities in the UK.
The organization hosts several
high-profile fundraising events,including World’s Biggest Coffee
Morning, Brave the Shave, and Go
Sober for October. Proceeds areused to provide practical, medical,financial, and emotional support forpeople affected by cancer.

8,000 Microsoft® Active Directory accounts for just over 2,300 users. Furthermore, theenvironment had no multi-factor authentication.”

We needed a solution that could automate the management of our service
accounts and also provide secure — but appropriately limited — third-party
access to systems.”→ Tim O’Neill, Head of Information Security, Macmillan Cancer Support

CASE STUDYCASE STUDY
Macmillan Cancer Support

O’Neill’s next step was to prioritize the risks. “We lacked theability to see when a person logged on, what device theywere using, what location they logged on from, who logged
on from two devices simultaneously — each of these things
added another element of risk,” he says. “These red flags madeidentity management and access rights our top priority.”
Because the organization collects no patient data, there wasno need to adhere to patient protection regulations, but they
had yet to achieve compliance with PCI and ISO 27001 security
standards. Also, as a common element of these and many

Delinea provided both PAM and thirdparty access, and its complementaryfeatures were logical and beneficial.”→ Tim O’Neill, Head of Information Security,
Macmillan Cancer Support

other standards, access to the environment by third parties
was not properly secure. Once third-party users were in thesystem, they were given too much freedom to move around the“I was also looking for complementary features that wouldenvironment.

help deliver a return on the investment,” he says. “We wanted aFinally, service accounts had become a management headache.

product that could mitigate as many risks as possible.”“If you manually manage each service account, you’ll eventually

The team evaluated a handful of privileged accessfail due to the amount of time and resources required,” says

management (PAM) and identity management products.

O’Neill. “We needed a solution that could automate the“Some solutions we evaluated were good at PAM, but didn’t

management of our service accounts and also provide secure

address third-party access. Others had so many offshoot— but appropriately limited — third-party access to systems.”

features that they felt complex and difficult to manage.
Delinea provided both PAM and third-party access, and its

Solutioncomplementary features were logical and beneficial,” he says.

As a charity, Macmillan is very aware of the fact that money

The final consideration was the relationship with thespent on IT roles is money not being used to help someoneorganization. “We wanted to work with a highly responsive

dealing with cancer. Every penny counts. But that doesn’t

security vendor that would help us improve our security

mean they went looking for the least expensive solution on

posture without having to rethink our processes, or to work inthe market.

a way that wasn’t natural to the organization,” says O’Neill.

“Our goal is to keep the team small, and we do that by selecting“While I was already somewhat familiar with Delinea, I wasn’t

the best products,” says O’Neill. “That makes ease of use

sure it had maintained its best-of-breed status,” he says. “Iessential. We look for tools that are easy to navigate, easy on

also wanted to ensure it was right for this environment.”

the eyes, and that help you to get in, get the job done quickly,
and move onto the next task.”

During the evaluation, Delinea met every key requirement.
“A short time after receiving the Delinea POC, I saw how weIn terms of functionality, the company identified their top

could provide secure, remote access for third-parties. They

three required features. The product would need to:

could log in and get access to systems they were authorized
to use, but they couldn’t move laterally, were time limited, and• Control all critical accounts.
• Provide secure third-party access.
• Help identify and manage high-risk service accounts
that often had administrative rights and passwords
that never expired.

their actions were recorded,” he says. “In no time, I had a list of
every service account on our domain, and could test service
account credential rotation. We found that Delinea delivered
the biggest bang for the buck.”

CASE STUDY
Macmillan Cancer Support

It further leaves no chance of a virus or malware spreading to
the internal systems, and it removes the need for NAC tools

In no time, I had a list of every
service account on our domain,and could test service accountcredential rotation. We found that
Delinea delivered the biggest
bang for the buck.”→ Tim O’Neill, Head of Information Security,
Macmillan Cancer Support

to guarantee workstation compliance with company protocols.
“The Delinea approach saves us time, money and resources.
By moving from VPN-based third-party access to Delinea, weeven eliminated the expense of VPN licenses,” says O’Neill.
In fact, cost savings over several areas have helped thecompany achieve an ROI. “As with third-party accounts,
managing service accounts manually is labor intensive andcostly. By automating, we’ve reduced those expenses as well,”he says. “I anticipate further cost, time and resource savings
once we integrate Delinea with our change management andticketing systems.”
But not all benefits have been cost or security oriented. “ThereResults
O’Neill’s team began by addressing the most critical risks. “Assoon as Delinea was installed, we started using it as a vault tosafely store credentials and automatically rotate passwords.
That one step tightened access, improved our security postureand provided immediate value. From there, we could define theparameters of who needed access to what,” says O’Neill.
The next step was addressing the risks associated with thirdparty access. “Third parties often come in to fix issues, so they
may need access all over the network,” he says. “But you haveto be careful because bad actors often use third-party accessto mount attacks. With Delinea, third-party users don’t evenare obvious business benefits. There’s a disaster recovery
benefit. There’s even a business continuity benefit for us: Prior
to Delinea, users stored passwords in vaults on their laptops.
So, if someone was out for a day, and they had credentials
nobody else had access to, we were stuck. We eliminated thatproblem as well,” he says.
“Today, we’re far more effective at protecting the organization.
We’re better protecting our patients at possibly the mostdifficult point in their lives. We’re protecting our employees
against executing tasks that might have unintended
consequences. Now, they can’t access servers unless there’s
a problem case or a project assigned to them.”

know what their access credentials are, and their actions aremonitored.”
Before Delinea, setting up and managing third-party accounts
was a time-consuming process. Now, they’re up and runningin minutes, with multi-factor authentication providing an
additional layer of protection. Third parties are granted accessonly to specific machines, for a limited amount of time, andtheir activities are recorded.
Rather than use a jump host, Delinea places the user
surgically on the target system while the workstation remains
unattached. That provides no exposure to the broader
network and prevents the user from moving around laterally.

The Delinea approach saves us time,money and resources. By movingfrom VPN-based third-party accessto Delinea, we even eliminated theexpense of VPN licenses.”→ Tim O’Neill, Head of Information Security,
Macmillan Cancer SupportCASE STUDY
Macmillan Cancer Support

Overall, the organization has achieved what they set out todo: “We’ve taken control of our most critical accounts. We’ve
automated password rotation. We’ve reduced the numberof total accounts and we’ve secured and streamlined themanagement of third-party and service accounts,” says
O’Neill. “We’ve even implemented a policy that allows only
Delinea jump boxes to RDP, even with permissions and accountdetails, you cannot RDP from anywhere else.”

Looking forward“Today, we’ve achieved all the primary objectives of the Delinea
project. Our next action will be to come back to the productand brainstorm all of its potential uses — whether intentional
functionality from the manufacturer or not. We’ll list those uses
out and see which ones best address any remaining risks, andthat will point us to the next stage of our work.”

According to O’Neill, “Security is often seen as difficult andfraught with danger as it typically requires change across theinfrastructure and the business. Delinea was a fast, effective
security project that challenged that perspective and helped
earn the security team respect across the organization.”

Delinea is a leading provider of Privileged Access Management (PAM) solutions for the modern, hybrid
enterprise. The Delinea Platform seamlessly extends PAM by providing authorization for all identities,
controlling access to an organization’s most critical hybrid cloud infrastructure and sensitive data to help
reduce risk, ensure compliance, and simplify security. Delinea removes complexity and defines the boundaries
of access for thousands of customers worldwide. Our customers range from small businesses to the world’s
largest financial institutions, intelligence agencies, and critical infrastructure companies. delinea.com© Delinea