Port of Antwerp, the Gateway to Europe, Relies on Infoblox to Keep Shipping Lanes Open 24x7x365

Embracing technological innovations while keeping risks under control is a key business priority for Yannick Herrebaut, Cyber Resilience manager at the Port of Antwerp. He sees this progress as simply the beginning of a continuum that will bring expansion of digital innovation into virtually every facet of port operation—for example, by the usage of drones, autonomous ships and a digital twin. “Our Chief Digital and Information Officer has outlined a vision for the Port of the Future that emphasizes challenging the status quo, seeing opportunities instead of problems and using technology as a lever for a sustainable future. With our competencies, we want to connect the entire port community via different ecosystems,” he explains. “Speaking of this path forward, our CEO has characterized our mission as ‘We want to be a world port that reconciles people, economy and climate’.”

Herrebaut and the port’s IT team believe that to really foster and enable this kind of innovation, they’ll need to position the port as a digital playground for all kinds of solutions to be implemented and tested. To that end, the port’s efforts to roll out 5G technology and various smart IoT devices—like drones, autonomous ships, smart lifebuoys and other types of digital equipment—constitute the Port of the Future’s technological underpinning. Yet as Herrebaut points out, IoT devices and appliances have a spotty reputation of often lacking the kind of cyber security protections necessary for deployment in a critical environment such as the port.

“Top of mind for us is that these are newer technologies that have not always been made with security as an essential aspect but rather as an afterthought,” he says. “We encourage proof-of-value cases to take place, but properly isolated from our core network. Very promising cases will be operationalized in time, but then they have to adhere to our security policies. The goal is to safeguard the confidentiality, integrity and availability of our core network, of which Infoblox is a critical element. By adding BloxOne Threat Defense to our cyber security stack, we can increase the security level of all our managed endpoints, including all the laptops of our employees who are working mostly from home these days.”

The Situation – Maintaining a Secure Work Environment in the Ransomware Age

Since the beginning of the COVID pandemic, the team at the Port of Antwerp has been facing the same challenges that cyber security decision makers around the world have been grappling with: an increasingly mobile, work-from home staff and an alarming rise in malicious data breaches and ransomware. “We’re an operational company, so the real enemy, the worst-case scenario is downtime,” Herrebaut says. “So obviously we’re very much looking to avoid downtime induced by ransomware at all costs.”

According to the Infoblox Q2 2021 Cyber Threat Intelligence Report, the total damage associated with ransomware is estimated to be as high as $20 billion annually, with more than 10 percent of all cyber attacks now involving ransomware. Cyber security researchers attribute much of this increase to the massive expansion in attack surfaces brought about by COVID-induced work-from-anywhere practices. For the port, work from home has been somewhat restricted by the realities of the shipping industry, but it’s still been a significant trend.

In total, Antwerp maintains a workforce of around 1,600 employees: a thousand of them designated as knowledge workers, the other 600 being mechanical engineers, sailors, ship officers and boatmen. Still, up to 700 of the port’s employees worked from home during the height of the lockdown. For Herrebaut and his team, bolstering the port’s security posture given its dispersed workforce became an imperative, and BloxOne Threat Defense from Infoblox was a natural fit.

The Solution – BloxOne Threat Defense

BloxOne Threat Defense is a proven solution for improving security effectiveness and resiliency. It operates at the DNS level to uncover threats that other solutions do not and stops attacks earlier in the threat lifecycle. Through pervasive automation and ecosystem integration, it drives efficiencies in SecOps, boosts the effectiveness of the existing security stack, secures digital and work-from-anywhere efforts and lowers the total cost for cyber security. For organizations in the transportation sector—a prime target of ransomware criminals—BloxOne Threat Defense provides comprehensive protection against today’s evolving threats. It uniquely combines advanced analytics based on machine learning, highly accurate and aggregated threat intelligence and automation to detect and prevent a broad range of threats, including DGA families, data exfiltration, look-alike domain use, fast flux and many others.

“BloxOne Threat Defense was the ideal solution at the right time for the port,” explains Herrebaut. “As a cloud-based offering—and because we already had Infoblox NIOS in place—the implementation time was very short. The only thing we needed to do to get up and running was define policies and then deploy the agents to our endpoints. It was all very quickly put in place, which was a great advantage given the lockdown situation.”

The Results – Strong Security Posture, Continuous Uptime

When the full lockdown edicts came down in 2020, Herrebaut and the team felt that they were in good shape to protect their remote workers and, by extension, their core network assets and operations. An upgrade to a full-scale extended detection and response (EDR) solution was underway, the port had long maintained a secure VPN and all company laptops were equipped with anti-malware applications. “While we were confident we had strong security measures in place, we were also aware that EDR systems and anti-malware can still miss certain threats, which is why felt we needed an additional layer of security,” Herrebaut says. “What BloxOne Threat Defense offered was that we could provide the same level of protection to our remote users that they would have when working on-premises.”

BloxOne Threat Defense enabled the port to enact the same kind of content restrictions that were applicable on the corporate network—such as categories of sites that should not be visited on a company device or anything related to the dark web. The unique hybrid security of BloxOne Threat Defense uses the power of the cloud to detect a broad range of threats while tightly integrating with the on-premises ecosystem. BloxOne Threat Defense also enables the port team to optimize the performance and effectiveness of their existing security stack. “BloxOne Threat Defense, in addition to our existing security tools, makes it possible for our team to better identify and remediate threats. Now, we’re able to source information out of the Infoblox solution and get it into our SIEM solution, which will then point us in the right direction to uncover threats or to intervene to prevent negative things from happening.”

As the Port of Antwerp expands its relationship with Infoblox through its BloxOne Threat Defense implementation, the team’s appreciation for the reliability and flexibility of their original NIOS DDI solution continues to resonate. “If I look at how Infoblox contributes to the core success of the business by providing reliable, performant and secure IT services, I would say greatly,” explains Herrebaut. “Without robust, always-on DHCP, DNS and IPAM, a lot of our core services would stop working and we would have a lot of angry colleagues. With Infoblox, we’re able to keep the port running continuously, which keeps our customers happy and profitable.”