ARCHITECT JOURNEY

MAN EnergySolutions

Ensuring Both Internal and External Application Accesswith a Cloud Security Architecture
Company:
MAN Energy Solutions
Type:
Manufacturing
Driver:Tony Fergusson
Role:	IT Infrastructure Architect

Revenue:
Employees:
Countries:
Locations:$4.3 billion
15,0006100

Company IT Footprint: MAN Energy Solutions has 15,000 people in over 100locations. It has fleets of engines on ships deployed all over the world. Its main
offices are in Germany and Denmark. This entity is actually part of the Volkswagen Group, so it is a part of a larger 650,000 person organization.

“To be successful, you really need to sell this concept of cloud transformation—you need to evolve the organizational mindset. This technology is so disruptive that you need the people inside your company
onboard.”
Tony Fergusson, IT Infrastructure Architect, MAN Energy Solutions

Excerpt from: Stiennon, Richard “Security Transformation” Secure Cloud Transformation: The CIO’s Journey. IT-Harvest Press, 2019, pp. 114-120.

1

MAN Energy Solutions Journey Overview

Business Objectives

The SolutionImpact• Reduce risk: Shield internal
applications from potential attacks• E stablish direct connectionaccess with inline security;
eliminate backhauling• Improved security:• Reduce network cost, complexity• Improve user experience• Secure seagoing vessel control
systems and monitoring access• P rotect internal apps, systemswith ZPA• Onboard third-party contractors• C onnect, secure access forremote seagoing vessels- Zero-trust default-deny threat
posture- Inspection of all traffic, including
SSL-encrypted- Protection against ransomware
threats• Improved user experience withfaster app access• Better management visibility intotraffic, app access• Reduced costs: sunsetted VPNs,
software licensing• Policy-based management,
integration for IoT devices• Faster M&A systems integration2

MAN Energy Solutions is a manufacturer of large engines andturbines with fleets of engines
on ships deployed all over theIn the words of Tony Fergusson:
Eight years ago, we started our journey to the cloud at MAN Energyworld. Tony Fergusson want-Solutions when I went down the path of creating a forward proxyed to move to a model wherefor access to the internet. I have been in the IT industry for over 20internal applications were notyears. I started with IBM in 1995, so really at the beginning of the internet. I worked

even visible to attackers. Onlyauthenticated users can see
them. He calls this stealth ap-at an application service provider (ASP) back in New Zealand, kind of the precursor
for what the cloud is today. I have been working in Europe for ten years, mostly inproach the “black cloud,” andDenmark for MAN Energy Solutions. While a lot of my experience is with Microsoft

MAN Energy Solutions uses

products like SharePoint and Office 365, I am actually a network architect.

the concept to securely accessengine sensors on its deployed
fleet. He shares how the organization truly discovered theflexibility

ofcloud-delivered

security when it had its first experiences with ransomware—
thanks to its cloud security ser-Moving to cloud-based proxies for internet and SaaS
applications
Our on-premises proxy gateways needed to be replaced, so I went to the market
and discovered Zscaler for secure internet access. At the time, 2011, they were very
new. Now I can say we have been a long-term customer.

vice, this was a non-event.

Back then, we backhauled all internet traffic from every location and had one connection to the internet. We saw that the future was direct access to the internet
from everywhere, while at the same time, we needed to inspect all that traffic. As aresult, over several years, we went to local breakouts everywhere and inspectionof all traffic in the Zscaler cloud security platform. From a security perspective, thismodel has been a huge success for our company. We discovered the flexibility ofcloud-delivered security when we had our first experiences with ransomware. Wesimply enabled Zscaler sandboxing for all of our users and the problem went away.

Secure access to internal data center applications without VPN
Back in 2014, I had a lot of discussions with Zscaler around what I call “black cloud”;
the whole idea was that my applications should not even be visible to attackers. In2015, we started beta testing Zscaler Private Access (ZPA). We first used it for the
many consultants we work with around the world. Our old system of VPNs was very
hard to manage. It was difficult to onboard people and get the visibility into what
they were accessing.

3

“We saw that the future

The first proof-of-concept (PoC) with ZPA was to onboard consultants and it wasvery successful. We quickly brought all of our consultants onto the platform andwas direct access to thewe went into full production in 2016, going live in April, the same date that Zscalerinternet from everywhere,

officially launched the product. That was when it dawned on me just how powerfulwhile at the same time,

this solution was, and we could really do a lot with this technology.

we needed to inspect allthat traffic.”

Secure access to engine applications in large ships
The next use case was to start looking at protecting our engines deployed in allof our seagoing vessels. There were only certain people that should be allowed
access to the control systems and monitoring software on those vessels so wedeployed ZPA.
One of the interesting things about ZPA is that it fulfills my vision of the black cloud.
Basically, ZPA acts as a broker for connections. The client software does not know
the IP address of the end system. A request is sent and if the requester is properly
identified and authorized to get access to the application—or, in this case, thesoftware running on the engine management platform—ZPA initiates the session.
It’s like the call-back setting on modems back in the day. The whole platform isbased on DNS, so you essentially extract the whole network from the equation.
Before ZPA, we were assigning a class-C network space to each engine on everyship. With ZPA, we basically created a namespace routing in between us and thecustomer. This allowed us to monitor hundreds of ships without looking for a newIP address range.
Now we can secure each connection, which we can define per user per application.
We have access control to each engine and we could add strong authentication
through identity federation. That led to a thought—why not just replace all of ourVPNs with ZPA for all users? After taking that step, it became quite apparent thatthe next step was to determine what our corporate wide area network was for andif we even needed a corporate network. Why not just put everyone on the internet
and secure the access through some sort of software-defined perimeter?
Certainly, we are not there yet but I think within the next few years we will be. Lookat WannaCry and NotPetya. Making the corporate campus one big open network
is a mistake. In the past, if users wanted access to unsanctioned things we could4

not support, we just told them no. Now we tell them if you want access to those
applications, you have to go through the Zscaler fabric.
We’re starting to migrate applications to AWS, and we have to deploy connectors
up there, so we’ll get connectivity for people to access them. I think of it as thecompany making its own black cloud. I don’t care where the user is or what device
they are on. I don’t care whether you are at the office or at home. I just need you toget to the application. If you go through this secure fabric, I know who you are andI know that you actually should have access to this app.
This is the top priority model I have been creating for the company. It is a complete
shift in thinking and has taken a couple of years to even solidify it in my head.

Securing the Internet of Things
The biggest problem with IoT is that these devices are generally not patched. They
are not complying with standards. They are a security risk. What we are doing isputting this secure fabric between the people who need to access them and the IoTdevices themselves.
To accomplish this, we found we needed to create a DNS naming structure. Now
our policy is set by DNS names, not IP addresses. I can have an A Record for adevice and several different CNAMES, and I can apply policy based on these. TheDNS becomes my policy catalog and manager. There is still a lot of thinking we haveto do about what this all means.

Better security against ransomware
I remember my management coming to talk to me after NotPetya did so much damage to Maersk. Management was rightfully very concerned. I just looked at themand said, “We’re OK. Everything is closed. Every client is closed. We closed thefirewalls to everything. The only way you can get to one of our engines is throughZscaler, through this black cloud. So everything is black. The malware has nowhere
to go.”

5

“To be successful, youreally need to sellthis concept of cloud

Cloud security for integrating M&A
Think about how this fabric applies during M&A. We did one acquisition in Zurich
and to onboard the new company, I just gave everyone the Zscaler client. As soon
as they had Zscaler Internet Access (ZIA), they were at the same security level astransformation—youwe were. Then, when they got Zscaler Private Access (ZPA) they could access ourneed to evolve theprivate apps. The whole process took just two weeks.

organizational mindset.”

Advice to infrastructure leaders
To be successful, you really need to sell this concept of cloud transformation—youneed to evolve the organizational mindset. This technology is so innovative thatyou need the people inside your company onboard. I spent a huge amount of timeinternally evangelizing to my CSO, my management, and everyone on why this isdifferent, and why this works. To further validate, I pointed to them why I was confident that we were protected, and was able to reassure them when they came down
to me worried about NotPetya.
Because of this technology, I was able to call a halt to a big 802.1x project we had
been working on for Network Access Control (NAC). NAC does nothing for me when
I go home or on the road. On the contrary, it can authorize someone infected with
NotPetya to get on the network and the next thing you know, everyone is infected.

What not to do
Don’t allow people to build direct IP connectivity into their applications. I wish I had
acted earlier to keep that from happening. Get your application developers onboard
earlier in the project cycle so they understand the new architecture.

6

Ready to transform your company?
Create business value with Zscaler today.
CONTACT US

REQUEST DEMO

https://www.zscaler.com/company/contact
https://www.zscaler.com/custom-product-demo

About Zscaler Zscaler was founded in 2008 on a simple but powerful concept: asapplications move to the cloud, security needs to move there as well. Today, we are helping
thousands of global organizations transform into cloud-enabled operations.
© 2019 Zscaler, Inc. All rights reserved. Zscaler™ is either (i) a registered trademark or service mark or (ii) a trademark
or service mark of Zscaler, Inc. in the United States and/or other countries. Any other trademarks are the properties of
their respective owners.

7