BMW: Security Driven

BMW Group Australia is one enterprise which opted to outsource some of its security function to a managed service provider. Under the arrangement, managed security service company, Network Box takes full responsibility for the German automotive company's perimeter security solutions in Australia, providing hardware, 24x7 managed service, follow-the-sun support, as well as all antispam, antiphishing, antimalware and intrusion prevention systems duties.

IT operations manager Con Papadopoulos says he's not worried about shifting ownership for security responsibilities to an outsider. Instead, he sees outsourcing the company's perimeter defences as an economical way to free-up resources and staff to focus on more critical issues. "We don't think of it as a purely outsourced deal, it's more of techno-clerical function," Papadopoulos says.

"Security doesn't wait until someone comes in at 8 o'clock in the morning to patch something. An exploit is not going to wait until business hours," Papadopoulos says. "We've got a team of people here whose job is supposed to be adding value to the business - turning out new solutions and implementing systems that allow the business to do things bigger, faster and better - and it's very difficult to have somebody watching the network 24 hours a day."

A subsidiary of BMW AG in Germany, BMW Group Australia distributes around 18,000 automobiles to its dealer network in Australia. The IT department serves around 300 internal employees in corporate offices as well as 70 or so workers in various dealerships throughout the country.

"Ten years ago security was not that much of an issue on the Internet side," Papadopoulos says. "We didn't have fast Internet connections or WAN connections going out to all sites. We've changed as a company because of the way we now do business with our dealers, and so we've taken a massive leap forward in terms of telecommunications".

Over the last couple years, BMW Australia's parent organization has been delivering solutions over an Internet-based portal, eschewing the usual "clean pipe" communications link extending over a private network back to Germany.

"The direction from our parent is to move everything to Web-based portals, but hand-in-hand with that our exposure on the Internet side has increased," Papadopoulos says.

"We're doing more via the Web, we've got more connections and everybody wants to do things wirelessly and access remotely. It's great to have the technology to give people access to information, but that has to be tempered with caution. You have to make sure it can be delivered securely first," he says.