Case Study

Northern Beaches Council

Northern Beaches Council chose Airlock Digital application control and allowlisting to improve its cybersecurity posture and achieve Australian Signals Directorate (ASD) Essential Eight Maturity Level Two for application control.
hero-airlock-case-study-northern-beaches-council

About Northern Beaches Council

Northern Beaches Council is a local government body formed from the amalgamation of Manly, Pittwater and Warringah Councils.

Learn more about Northern Beaches Council by visiting www.northernbeaches.nsw.gov.au.

icon-challenge
Challenge
Northern Beaches Council sought to improve its cybersecurity posture by using application  control and allowlisting to complement its endpoint detection and response strategy and achieve Essential Eight Maturity Level Two for application control.
icon-computer
Approach
After seeking advice from its trusted cybersecurity partner, Northern Beaches Council chose Airlock Digital application control and allowlisting to meet its needs.
icon-result
Result
Deploying Airlock Digital enabled Northern Beaches Council to implement advanced allowlisting across its entire organization, including its DevOps team.

“Airlock Digital solution checks are completed over a coffee each morning.”


Michael Turner, Chief Technology Officer, Northern Beaches Council

Benefits to Northern Beaches Council

With Airlock Digital application control and allowlisting, Northern Beaches Council has:

icon-challenge
Moved seamlessly from Essential Eight Maturity Level Zero for application control to Maturity Level Two
icon-computer
Achieved award-winning leadership in the local government sector for the deployment of application allowlisting and a strong cybersecurity posture
icon-result
Blocked large numbers of unwanted applications, nuisanceware and malicious files that users attempt to initiate via public PCs in libraries

The Customer

Northern Beaches Council in Sydney provides services to a community of over 266,000 people. 

The council aims to be a leader in cyber risk management and is using best-of-breed technologies to realize its ambition. Responsibility for executing this vision lies with Chief Technology Officer Michael Turner.

The Challenge

Northern Beaches Council wanted to upgrade its cybersecurity to protect users and the community, comply with government mandates, and be recognized as a leader in the field within local government. 

The council identified gaps in its architecture and assessed its posture in relation to Essential Eight mitigation strategies. When measured against the Essential Eight application control strategy, the council was at Maturity Level Zero and its project called for achievement of Maturity Level Two. 

The council pursued a best-of-breed cybersecurity product strategy and Turner’s team asked existing vendor CrowdStrike and its trusted cybersecurity partner to recommend an application allowlisting product. Both nominated the Airlock Digital application control and allowlisting solution.

The Approach

“When we looked at the relevant factors, it was clear that deploying Airlock Digital would be our best course of action,” said Turner. 

After purchasing Airlock Digital in March 2022, the council ran the product in audit mode for four to six weeks to identify all the applications and processes running in its environment. It then adopted a rolling, month-long process to move its endpoints into enforcement mode. 

Airlock Digital now runs on 2,000 endpoints, including all workstations and a hybrid on-premises and Microsoft Azure cloud server environment. “All hardware and software we distribute has Airlock Digital deployed as standard and we check through that process whether the product is configured properly and showing up on the console correctly,” said Turner.

Throughout its change management program, the council informed all users that Airlock Digital was running as a control for compliance and to help improve its security posture. 

Any user that sees a pop-up advising that Airlock Digital blocking an application can raise a support ticket with the council’s service desk. The desk typically receives one or two tickets per week from users who want to run legitimate software not on the council’s allowlist.

The Result

With Airlock Digital application control and allowlisting, Northern Beaches Council is achieving its principal cyber security compliance objective.

“Airlock Digital has enabled us to achieve Essential Eight Level Two Maturity for application control in line with government guidance to councils,” explained Turner. 

“We are making strides towards being a local government leader in cybersecurity and councils in NSW and Victoria are reaching out to learn from us,” he added. “The Airlock Digital solution does exactly what it says it does, which is critical for such a foundational cyber security technology.” 

The product includes a purpose-built One-Time Password (OTP) feature that allows administrators to issue time-limited exemptions that enable users to access unapproved applications in urgent circumstances. This ensures support tickets are quickly and efficiently resolved, reducing any friction users may experience with the allowlisting deployment. 

With Airlock Digital installed and running the daily management effort is minimal, with Turner noting “Airlock Digital solution checks are completed over a coffee each morning.”

The solution also enables Northern Beaches Council to extend allowlisting enforcement coverage to its DevOps team, that develops and deploys to a range of locations at speed, with only minimal disruption. 

According to Turner, Airlock Digital “just works” and has stopped several unwanted applications, scripts and installers from executing in the Northern Beaches Council environment. “We do have users who try to install applications or potentially invasive tools on public computers in our libraries,” he explained. “Airlock Digital in combination with other tools enables us to detect these attempts and gives us protection in this space.”