{"id":35326,"date":"2019-11-13T11:48:17","date_gmt":"2019-11-13T11:48:17","guid":{"rendered":"https:\/\/www.intelligentcio.com\/eu\/?p=35326"},"modified":"2019-11-18T08:50:37","modified_gmt":"2019-11-18T08:50:37","slug":"tesco-secures-distributed-workforce-with-onelogin-mfa-solution","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/eu\/2019\/11\/13\/tesco-secures-distributed-workforce-with-onelogin-mfa-solution\/","title":{"rendered":"Tesco secures distributed workforce with OneLogin MFA solution"},"content":{"rendered":"\n

Luke Fairless, Technology Director – Security and Capability at Tesco, tells us how the company is using an identity and access management solution from OneLogin to secure its distributed workforce. <\/em><\/p>\n\n\n\n

With the exception of its banking operation, Luke Fairless\noversees cybersecurity strategies across Tesco\u2019s range of operations including\nits Express businesses, superstores and metros in the UK, Ireland, Europe, Asia\nand other global offices. <\/p>\n\n\n\n

His team looks after everything from risk compliance through\nto digital forensics, the Security Operations Centre and identity access\nmanagement. <\/p>\n\n\n\n

He\u2019s also tasked with ensuring security awareness and\neducation across all 450,000 colleagues in offices, shops and distribution\ncentres. <\/p>\n\n\n\n

Tesco was looking for a multi factor authentication\nsolution that would provide visibility over account access and ensure sensitive\nemployee data did not end up in the wrong hands. <\/p>\n\n\n\n

Here, we find out more about the solution Tesco chose and how it is already providing benefits.<\/em><\/p>\n\n\n\n

The challenge<\/strong><\/p>\n\n\n\n

Tesco is increasingly using cloud services and while it is only\noffice staff and store managers who have access to email, the wider workforce\nis accessing pay slips from the cloud. <\/p>\n\n\n\n

\u201cAnybody working in stores or distribution centres, as well\nas offices, need to be able to log into that,\u201d Fairless said.<\/p>\n\n\n\n

\u201cAnd we want to be able to protect it because pay slips\nhave got a lot of information on them that you could use to try and do an\nidentity takeover of somebody. <\/p>\n\n\n\n

\u201cIncreasingly we want to be able to make these self-service\nso if you need to change your bank account details then you can just do it\nyourself online rather than needing to come through your personnel manager. <\/p>\n\n\n\n

\u201cIf you’re allowing people to do that though, you can imagine\nan attacker could change that bank account detail to their own just before the\nmonthly paydays. <\/p>\n\n\n\n

\u201cAnd then suddenly people\u2019s salaries don’t end up in their\nown bank account, they end up in a fraudster\u2019s bank account. <\/p>\n\n\n\n

\u201cSo the need to be able to protect those accounts is\ncrucial and it’s been a need that we’ve been able to see for a year or two, but\nwe can increasingly see it as a need as we go forward.\u201d<\/p>\n\n\n\n

The solution<\/strong><\/p>\n\n\n\n

Enterprises are now required to have a second factor of\nauthentication in place as username and password information \u2013 something you\n\u2018know\u2019 \u2013 are increasingly easy to pass on to attackers, even if only\naccidentally.<\/p>\n\n\n\n

Fairless turned to OneLogin for a solution, won over by the\nease of use and partnership approach the vendor was able to offer.<\/p>\n\n\n\n

The second factor now used by Tesco employees is a mobile\nphone \u2013 something which employees \u2018have\u2019 and much harder for attackers to\naccess. <\/p>\n\n\n\n

The solution protects against unauthorised access to critical\ncorporate data while cutting management time and costs for the business.<\/p>\n\n\n\n

Why OneLogin?<\/strong><\/p>\n\n\n\n

\u201cWe trawled quite a wide net through the market,\u201d said Fairless.\n\u201cWe ended up looking at eight solutions and got down to a shortlist of three. <\/p>\n\n\n\n

\u201cOneLogin wasn\u2019t the biggest or the most established \u2013 they\nwere quite a new player in the market. But the thing\nthat really made them come through was user experience and that\u2019s from\ntwo different angles. <\/p>\n\n\n\n

\u201cIt was very important to us that if we were going to ask 450,000\npeople to use this thing \u2013 many of whom are not what we would describe as\ndigital natives \u2013 we wanted it to be an easy experience\nfor them and we wanted it to be intuitive.\u201d<\/p>\n\n\n\n

Equally important, he said, was a solution that would be\nintuitive for administrators. <\/p>\n\n\n\n

\u201cWith some of the solutions we looked at, when we looked at\nthe administration side and how they would set up security policies it was very\ncomplicated and you could see how they could easily make mistakes that then\nwould compromise the reason why you bought the solution in the first place. <\/p>\n\n\n\n

\u201cSo OneLogin seemed like they had really concentrated on\nuser experience from both angles.\u201d <\/p>\n\n\n\n

The implementation<\/strong><\/p>\n\n\n\n

The solution was initially rolled out in the UK over a\nnine-week period which finished in June this year and then expanded to Europe\nand Asia, which took around four weeks. <\/p>\n\n\n\n

Initial teething problems centred around the inputting of\ninternational phone numbers but OneLogin were very responsive in resolving the\nproblem, said Fairless.<\/p>\n\n\n\n

The benefits<\/strong><\/p>\n\n\n\n

Tesco now has 140 applications which are integrated with OneLogin.\n<\/p>\n\n\n\n

\u201cWe’ve got tens of thousands of colleagues now across the\nworld that are all using adaptive multi factor authentication,\u201d said Fairless. <\/p>\n\n\n\n

\u201cFor example, I’ve just been to Malaysia, India and the US.\nAnd in each of those locations, which are unusual for me because I’m normally\nbased in the UK, when I first go to log into one of those 140 apps that are\ncovered by OneLogin, I get a notification on the screen saying \u2018we just sent\nyou a message to your phone, please confirm in order to continue\u2019. <\/p>\n\n\n\n

\u201cAnd I then get a push notification which asks \u2018is this you\ntrying to log in?\u2019. You then approve it and login immediately.\u201d<\/p>\n\n\n\n

For the remainder of the time the individual is in that\ncountry, they\u2019re not repeatedly asking to confirm their identity as the\nsolution recognises that it is a legitimate login.   <\/p>\n\n\n\n

\u201cIt’s about providing us the\nassurance that these logins are from bona fide individuals, but not\noverburdening the individual by having them have to do this process every\nsingle time, only when something looks unusual,\u201d said Fairless.<\/p>\n\n\n\n

Tesco received the \u2018Most\nCollaborative Award\u2019 award from OneLogin for <\/strong>demonstrating a fast implementation and\ndeployment of the solution through cross-departmental team efforts. What\u2019s the\nkey to this success?<\/strong> <\/p>\n\n\n\n

\u201cA really big thing for us was that\nwe wanted colleagues to understand why we were doing it, not just be the\nsecurity team saying \u2018you must do this\u2019,\u201d said Fairless.<\/p>\n\n\n\n

\u201cSo we worked with the corporate comms team to create a\nvideo which took about five minutes for colleagues to view, explaining why we\nwere asking them to do it, what it would achieve and then talking them through\nthe specific steps for installation.\u201d<\/p>\n\n\n\n

Although there is an app version, employees can also\nsubscribe to the solution as text messages instead, so if they have an older\nphone, limited storage or an incompatible device, they can use the SMS option\ninstead. <\/p>\n\n\n\n

\u201cBy working with the comms team, we got this really clear\nand quite compelling story that folks could go through and then working with\nthe Service Desk team to be able to put FAQs and self-help and other things on there\nfor the education side. <\/p>\n\n\n\n

\u201cThen working with OneLogin, and we’re still doing this, we\nhave a number of observations and builds for them as we’ve gone through. <\/p>\n\n\n\n

\u201cSo being able to work with OneLogin and them being really\nreactive to us, suggesting this stuff and helping, I guess, from our\nperspective, us helping them develop their product, from their perspective, them\nhelping us get this thing rolled out across all of our users.<\/p>\n\n\n\n

Advice for other CEOs looking for an multi\nfactor authentication or identity access management solution? <\/strong><\/p>\n\n\n\n

\u201c<\/strong>I think it’s tempting to go\nwith a vendor that maybe you already use. Because it will seem like they’re\ngoing to take a lot of the complication and the stress away, because you deal\nwith them already \u2013 maybe it’s an add on product or something they already do,\u201d\nsaid Fairless.<\/p>\n\n\n\n

\u201cBut instead of taking that for granted, I would recommend diving\ninto how it is actually going to work, what it’s going to look like for the\nuser and what it’s going to look like for the admins.\u201d <\/p>\n","protected":false},"excerpt":{"rendered":"

Luke Fairless, Technology Director – Security and Capability at Tesco, tells us how the company is using an identity and access management solution from OneLogin to secure its distributed workforce. With the exception of its banking operation, Luke Fairless oversees cybersecurity strategies across Tesco\u2019s range of operations including its Express businesses, superstores and metros in […]<\/p>\n","protected":false},"author":28,"featured_media":35485,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[205,57,1735,93],"tags":[564,13860,4807,13861],"class_list":["post-35326","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-case-studies","category-enterprise-security","category-retail","category-top-stories","tag-cybersecurity","tag-luke-fairless","tag-multi-factor-authentication","tag-technology-director-security-and-capability-at-tesco"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/35326","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/users\/28"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/comments?post=35326"}],"version-history":[{"count":3,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/35326\/revisions"}],"predecessor-version":[{"id":35332,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/35326\/revisions\/35332"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media\/35485"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media?parent=35326"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/categories?post=35326"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/tags?post=35326"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}