BAT Case Study

British American Tobacco chooses Vordel's XML security appliance to manage and protect its XML Web Services

Company

British American Tobacco (BAT) employs almost 100,000 people worldwide, with 85 factories operating in 66 countries. As a large global organization, BAT has a diverse and complex IT environment which includes SAP, Siebel, and Oracle systems. In order to cost-effectively integrate its enterprise applications together, BAT has made a strategic commitment to Web Services technologies. These Web Services technologies, such as XML and SOAP, allow for easier access to data which was previously buried deep inside back-office systems. Web Services technologies enable BAT to be more flexible, by displaying real-time shipping data on "dashboards" for executives to monitor, and by removing the requirement to manually re-key data between systems.

Challenges

With the power and flexibility of Web Services comes significant security and management challenges, however. These challenges must be overcome by any organization which wishes to take advantage of Web Services technologies.

In BAT, the business intelligence data exposed by the new Web Services layer is highly sensitive. Therefore, the company required strict access control to this data in order to ensure that only authorized users could view appropriate data.

In addition, the data had to be encrypted while in transit across the network. XML data had to be scanned for new attacks such as "XML Denial of Service" attacks. The solution also had to be platform-agnostic, since both J2EE and .NET platforms are used within the firm.

Security policies needed to be enforced throughout the company's architecture, not just at the network perimeter. This deters internal attacks and also allows a full evidential audit log of user access to the core business systems. Information from this audit log information was required to be presented in a simple but powerful Web-based interface, in order to allow BAT executives to monitor the access to their new Web Services.

Finally, performance is a key requirement for the security and management solution. BAT requires a solution which would not slow its XML traffic down.

Why Vordel?

Vordel's XML Security appliance, VS3000, was deployed at BAT's data centre to provide high performance, scalable security for BAT's XML data flows. Through its support for transport-level security standards such as SSL, as well as message-level security technologies such as WS-Security, the VS3000 provides full spectrum protection for BAT's XML traffic.

Vordel's proven interoperability with SAP XI and Oracle was also an important factor in BAT's decision to choose Vordel.

Furthermore, Vordel's solution creates an audit log of transactions and its alerting functionality is applied to ensure uptime and integrity of all the services made available to the authorized employees and partners accessing these services.

Benefits

A strategic solution which means that BAT does not need to revisit security considerations for Web Services
BAT chose Vordel as a strategic solution to provide a security and management umbrella for its Web Services traffic, rather than choosing short-term solutions such as relying on platform security or using programming toolkits. This strategic solution gives BAT the security and management bedrock on which to run its Web Services projects for the future.

Reduce maintenance costs - by centralizing its security policies for XML traffic, BAT protects itself from costly management of multiple "silos" of security information.

Re-use existing security infrastructure - Vordel's products integrate with identity management infrastructure, such as directories, which are already in use within BAT.

Compliance with regulatory guidelines for auditing and non-repudiation - via maintenance of full audit trail of the various business services usage.

"With Vordel, BAT has been able to provision a global security infrastructure that is aligned to both technology and business drivers in a way that is standards based and fully conformant to company best practice in the security-operations space. Vordel's products provide BAT with the essential security and management framework to take advantage of Web Services technologies."

Gavin Targonski, Technical Architect - Application Technology Strategy

To find out more about this study and how Vordel's products can help your company email

JavaScript must be enabled to display this email address.

.