For VLI, 8,000 kilometers of railway, 100 locomotives, 6,700 wagons, eight intermodal terminals, four strategically located loading ports, 8,000 employees, and 1,000 contractors are required.
As complex as logistics and transportation may be, the challenges go far beyond simply moving products from Point A to Point B.
As owner and operator of an integrated rail, port, and terminal logistics system, VLI must comply with numerous government regulations related to compliance, safety, protection, and other factors.
To comply with railway regulations established by Brazil’s national regulator for the land transportation sector, the National Land Transportation Agency (ANTT), VLI must demonstrate how it safely manages its trains and railways. Additionally, in 2014, the company was organized as a holding, a business model subject to numerous governance laws and regulations, as well as some operational and safety rules that must be followed.
“We are a company with many government regulations. In Brazil, port regulations require us to have specific controls and processes related to safety. In the end, regulations are related to technology, so identity management is important to me.”
Thiago Galvão, VLI’s Chief Information Security Officer (CISO).
With IBM Security solutions, VLI minimizes malware and ransomware attack risks.
“We have about 9,000 people who need access to our different systems to move trains. Time is crucial – a new driver can’t wait to unload a truck. He needs access to records of product movements and transactions.”
Thiago Galvão, VLI’s Chief Information Security Officer (CISO).
As part of the cargo loading and unloading process, truck drivers and railway operators had to repeatedly connect to systems to access reports and transactions, making the process slower and reducing productivity.
Despite the company having large IT and development teams, there was no way to track or trace privileged users accessing VLI servers. The process of onboarding new employees and granting access to systems and applications took weeks because it was done manually. And the company also relied on paper-based processes, which require a lot of manpower, to manage user lifecycles and perform other user access-related controls.
When Galvão joined the company in 2018, he immediately recognized the need for identity and access management (IAM) solutions.
“We had no identity in the past,” he says. “I did an assessment and showed the board the risks and the importance of having a system to control user access.”
A portfolio of security solutions
VLI’s approach to choosing a provider for its identity governance and administration (IGA) initiative was a meticulous six-month process. A key factor for the project was business empowerment; specifically, having the ability to provide users with the right access to the right resources at the right time. Ultimately, VLI chose IBM for its local presence and support, its range of offerings, and the cost-effectiveness of its solutions.
“We started the RFP process [solicitação de proposta] looking for many solutions,” Galvão recalls. “We create scenarios. We did benchmarks. We analyzed how the solutions were integrated. And we create scorecards.“
He continues:
“We decided on IBM for a combination of reasons:
technology, local support and price.We validate the technical integration and that the solution works for us. We have validated that IBM can meet our expectations. But it was also very important for me to have support in Brazil because we need to have a relationship too. IBM paid attention to us. And the third reason was the price. So we made a big investment in IBM.”
Today, VLI is IBM’s first customer to implement solutions across the entire IBM Security Identity and Access Management product portfolio. To assist with integration and deployment, VLI turned to IBM Business Partner Qriar, a technology company specializing in cybersecurity solutions.
Qriar has been involved with VLI since the early stage of RFP response. It is working with the company throughout the project, from planning and defining architecture to deployment, installation, configuration, and customization of IBM products according to the customer’s needs and best practices.
VLI implemented the solutions in four phases.
Phase 1, which began in September 2019 and ended two months later, focused on IGA. During this period, the company deployed IBM Security Verify Governance software and the Microsoft Azure Active Directory platform.
IBM software automates processes that used to be cumbersome, such as access certifications, access requests, and password management. It also provides detailed reports and recertification campaigns to ensure that users receive only the access rights they need to perform their jobs.
In Phases 2 through 4, VLI implemented three solutions from the IBM Privileged Access Management package: IBM Security Verify Privilege Vault technologies, IBM Security Verify Privilege Manager for Client, and IBM Security Verify Privilege Manager for Server.
IBM Security Verify Privilege Vault software helps protect VLI’s most confidential servers by eliminating the need for shared passwords from privileged users. The session recording feature logs all actions performed on the servers, providing extensive audit trails and helping VLI manage compliance with strict identity governance requirements.
IBM Security Verify Privilege Manager technologies help VLI minimize the risk of malware and ransomware attacks by reducing the number of non-administrative users who have administrative privileges on terminals. VLI can also configure trusted and untrusted application and command lists and customize elevation policies.
From trucks to trains, gains throughout the company
By implementing IBM Security solutions, VLI has seen benefits from the loading docks to the bottom line.
The software automates processes that used to be laborious, such as access certifications, access requests and password management. In the past, these activities could take up to five days, causing delays and frustration for workers. Access requests are now granted automatically after approval by a manager, or 99% faster than before.
“We have 8,000 employees and around 1,000 contractors and customers,” explains Galvão, “so around 9,000 people who need access to our different systems to move the trains. It’s crucial for time – a new driver can’t wait to unload a truck. He needs access to records on product movements and transactions.”
By eliminating the delays and frustrations associated with accessing the system, employee satisfaction and productivity improved.
“We measure our performance according to the total weight of the cargo we handle on the railroad,” says Galvão. “In April 2020, we reached the highest figure in the company’s history.“
IBM’s solutions are also helping to minimize the risks related to cyber threats and access to the system by unauthorized people. Galvão concludes:
“A key point is the risk and prevention of attacks. Before, users who left the company could still be activated in the system. It was because we had no standards. Maybe we had external people using our systems and we didn’t know who.
“Now I have controls. Now we’re investing in identity solutions and increasing the number of integrations.”
Thiago Galvão, Chief Information Security Officer (CISO) at VLI.