FTPalert Case Study
NFU Mutual is one of the UK's leading insurance companies.
Based in Stratford-upon-Avon and established nearly a century ago, it has built on its traditional farming heritage and has grown and diversified to become the UK’s leading rural insurer. Operating through a network of more than 350 local offices throughout the UK, NFU Mutual generates annual turnover in excess of £1 billion. The agents, who are connected to the IT centre in Stratford via ISDN links, generate business through a wide range of insurance products, for both business and private needs, from life and general to pets and possessions.
Until relatively recently, data exchanges between the agents’ offices and NFU Mutual’s corporate headquarters were transacted on diskette. The data, which was submitted monthly from the agents, was input to batch routines primarily for accounts reconciliation. In return, a revised set of reports were generated and written to diskette before being posted back to the Agents. Although this process was well established, it was labour intensive and cumbersome. As a result, secure, cost-effective alternatives were continually being sought.
The incorporation of TCP/IP, and in particular the associated File Transfer Protocol, as an integral part of the OS/390 operating system appeared to offer the ideal solution. FTP was easy to use, worked cross-platform and incurred no additional capital expense - a significant factor in a cost-conscious environment. However, the FTP route was not quite as smooth as anticipated as Phil Pecksen, Technical Support Manager at NFU Mutual explained:
“We are running OS/390 V2R10 on a z-Series box and plan to go z/OS V1R4 later in the year. At first, FTP looked like a very attractive solution for our requirement to replace the diskette handling process. However, at a number of Large System Guide meetings, users had warned us of a potential weakness in FTP security. When we investigated this for ourselves, we were able to confirm that FTP appeared to by-pass all security processes, including RACF. This meant that it would be possible for any FTP user, either maliciously or accidentally, to overwrite critical corporate data - a totally unacceptable situation for both us and our users. We knew that FTP had the potential to offer improved service levels to our user base. What we needed was a means of making it secure.”
Enter FTPalert.
When William Data Systems told Phil Pecksen about the features of FTPalert, he immediately recognised that this could be the key to secure the FTP operation at NFU Mutual. In particular, the fact that it worked with all established host security software meant that NFU Mutual’s RACF system could be used to manage their FTP users - something which was previously impossible.
Installing FTPalert couldn’t have been simpler. Phil Pecksen simply downloaded the software from the William Data Systems website and followed the simple, five-step installation procedure - a process which typically takes no more than 30 minutes. Once FTPalert had been installed, NFU Mutual were able to see and audit both inbound and outbound FTP traffic. Furthermore, through the FTPalert security interface, they were able to restrict access, by user, down to the command level. This meant that, depending on access authority, users could be limited to doing nothing more than make a file available for delivery.
As Graeme Westerman, Senior Systems Programmer at NFU Mutual, observed:
“The arrival of FTPalert made a fundamental difference to the way we viewed FTP as a communications resource. With FTPalert installed, we are confident of our ability to secure FTP processes and are happy to consider it as the transport of choice for all cross-platform file movement. The audit trail provided by FTPalert means that we know precisely who moved, or attempted to move, what, where and when and we can limit access to FTP commands to those users who are entitled to use them. With FTPalert installed, there is now no data movement for which we would not consider using FTP.”
Although NFU Mutual’s selection of FTPalert was based exclusively on the need for enhanced FTP security, they were delighted to discover some powerful, additional benefits. Kevin Chamberlain, Operations Manager at NFU Mutual, explains:
“FTPalert has enabled us to realise some significant productivity gains in a number of areas. When files are FTP’d to or from the server, FTPalert generates advisory messages. These messages are trapped by our automation software and used as the trigger to initiate critical batch processes and maximise batch throughput. At the conclusion of those batch processes, the resultant reports are FTP’d directly to the appropriate desktop and an e-mail alert is issued to advise the recipients of report availability. No more diskettes, to create, reports to print or associated postal delays; simply enhanced user service.”
The Help Desk and operations personnel also benefited from the arrival of FTPalert through the inclusion of a library of FTP error messages and associated explanations. This has helped to accelerate FTP problem resolution and improve responsiveness to users.
As Phil Pecksen confirmed:
“FTPalert has proved to be an invaluable and cost-effective addition to our FTP service. Thanks to FTPalert, NFU Mutual has been able to implement FTP with confidence and has solved many of the operational problems which had previously appeared insurmountable”.