A pragmatic and encompassing cyber security approach for SBB Accountants & Advisors

With SBB Accountants & Advisors handling its clients’ confidential data, it wanted to attain a higher security maturity level, but lacked the in-house expertise. Cegeka offered SBB an effective and future proof cybersecurity roadmap that would ease the operational pressure.

With over 22,000 clients, SBB Accountants & Advisors provides a range of services including accountancy, taxation, financial and strategic advice, estate planning, and environmental, business, and legal advice. By combining local expertise from 30 branches throughout Flanders with a central team of legal experts, tax specialists, and economists at their headquarters, SBB translates in-depth knowledge into clear, tailor-made advice.

Cegeka has served as a trusted partner to SBB for more than ten years, providing server and workplace infrastructure management. Davy Haesen, SBB’s CIO, explains: “Our IT department isn’t small, but it mostly comprises developers. When cybersecurity threats started emerging several years ago, we wanted to reach a higher security maturity level due to the sensitive nature of our customer data. However, we didn’t have the required in-house expertise, so we searched for a competent security partner to proactively secure and improve our IT environment without increasing the workload of our IT staff.”

SBB operates entirely in a cloud-based IT environment, specifically Microsoft Azure, so the company wanted a cloud-based security solution that was scalable. Davy Haesen adds: “While we lack the resources to set up a dedicated team of security experts, a managed security solution gives us the reassurance of having experts at hand who are focused on our security.”

Cegeka won SBB’s bid, and Davy Haesen largely credits this to its encompassing approach: “Cegeka doesn’t just focus on the security of our IT environment, but also works towards making our employees more cyber resilient. And most of all, Cegeka’s team feels like a natural extension of our in-house IT team. We work together really closely.”

“Cegeka’s team feels like a natural extension of our in-house IT team. We work together really closely.” 

 

Davy Haesen, CIO at SBB Accountants & Advisors 

A pragmatic approach

Davy Haesen greatly admires Cegeka’s pragmatic approach, stating: “They really thought about making the security measures achievable for everyone, step by step. Rather than just deploying state-of-the-art security solutions, they focus on gradually rolling out security processes, making us more cyber resilient step by step. This is how our users gradually got used to security restrictions on USB devices or data sent from Office 365 to outside.”

Before improving the security of SBB’s environment, Cegeka dedicated significant time to interviewing all stakeholders, from C-level management and department heads to product managers and end users. “Cegeka really incorporated their feedback thoughtfully,” emphasizes Davy Haesen. By using the Cegeka Security Assessment Framework (CSAF), Cegeka grasped SBB’s security maturity level and defined an effective and future-proof cybersecurity roadmap

Prioritizing issues 

Cegeka’s first step was to deploy the technical components to scan SBB’s network for security issues. Sentinel, Microsoft’s cloud-based security information and event management (SIEM) solution, played a pivotal role in this process. “Cegeka also rolled out threat and brand intelligence, continuously scanning the internet and the dark web for exposed credentials,” adds Davy Haesen.

Cegeka’s security experts then analyzed the results and prioritized them accordingly. This process happened in close collaboration with SBB, explains Davy Haesen: “Together, we decided which issues were critical and should be resolved first, and then they systematically resolved the list of open issues. The monthly meetings with our CISO clearly showed progress, with no open critical issues anymore after a few months. This definitely gave us peace of mind.” Cegeka’s security observability dashboard, part of its customer engagement platform Horizon, also offered a comprehensive overview of security alerts, incidents, trends, and threat news.

Security without having to think about it 

Davy Haesen also praises Cegeka’s understanding of the balance between security and usability: “They implemented a seamless solution with single sign-on, multi-factor authentication and an always-on VPN. So our end users now only need to log in once when they arrive at their workplace, after which they can work securely for the rest of their day without having to think about any additional steps.”

So far, SBB’s security measures have been centered around workplace management. However, SBB also follows a bring your own device (BYOD) policy for mobile devices. “We now want to incorporate mobile threat management to also safeguard data on mobile devices,” reveals Davy Haesen. Additional steps are planned to improve user awareness. “We’ve rolled out a continuous phishing campaign among our employees, linked to a training program to prevent successful phishing. We aim to reduce the click rate on these phishing mails.”

“Our end users now only need to log in once when they arrive at their workplace, after which they can work securely for the rest of their day.” 

 

Davy Haesen, CIO at SBB Accountants & Advisors