Success Story
Together Housing Group: How a Regional Housing Association Reduces Cyber-risk by 32%
- 32% risk reduction in 12-month period.
- 70% decrease in overall cybersecurity complexity through consolidation.
- Scaled to meet company growth without adding additional cyber personnel.
- Less time and budget spent on compliance activities.
- Cost reductions across multiple areas.
INTRODUCTION
Together Housing Group is a leading housing provider in the North of England, owning and managing over 37,000 properties and providing a range of support services for residents. It is a non-profit organization, meaning any profits are reinvested for the benefit of residents and communities. Together Housing Group also provides supported housing and extra care schemes and funds community projects through its charity, Newground Together.
Supporting this diverse, highly distributed environment are over 1,700 direct staff members who depend on a combination of laptops, mobile devices, on-premises servers, and cloud-delivered applications to support daily operations.
As a publicly funded, not-for-profit operating entity, Together is required to go through a full, due-diligence process for each contract renewal cycle, using a formal Request for Quotation process and an in-depth evaluation of solution providers for each 3-year contract period. Trend Micro was the only solution provider to meet all requirements out of the box, and Together Housing Group has maintained a 12-year, ongoing relationship with Trend Micro.
Technology is foundational to virtually every aspect of the Together Housing operation. With more than 500 direct workers maintaining and repairing properties, the ability to dispatch, track, and manage this highly mobile workforce is critical to the families depending on housing.
The health and confidence in this critical operating environment underlie the continued growth of this highly scrutinized not-for-profit organization, enabling continued lending and property investment to support the growing needs of the community.
THE CHALLENGE
Prior to working with Trend Micro, Together operated multiple siloed security solutions from multiple security vendors. Web filtering, phishing, VPNs, etc. were all separate. “It was almost impossible to trust,” said Assistant Director for ICT Stuart Curran.
Many of Together’s users utilize multiple devices, including laptops and mobile devices, and many work within a virtual desktop environment. In isolation, an activity from an individual device might not appear malicious, but when activities are monitored across all devices, a different story is often seen.
One of Together’s biggest challenges was awareness outside of IT. “We used to be called ‘blockers.’” Curran reported that he learned that Together’s security awareness needed to begin at lower levels within the organization, communicating the importance of cybersecurity to the success of the operation. As they got lower levels on board, they were then able to move up to the executive team.
The team learned that it needed to participate in other groups and show up, share, involve others, explain the impact of security, and engage them at a level where people start getting on board and asking questions. They needed to make it personal whenever possible. And when they did this, they were able to build a strong cybersecurity culture across the organization.
As a not-for-profit organization, compliance with UK Cyber Essentials is critical. Curran regularly depends on self-assessment activities to prepare himself and his team for when auditors come in and start asking questions. He further adds that these activities help with maintaining the right levels of cyber insurance.
Together experienced many challenges that touched multiple business areas, such as the technical environment, resourcing, policies, and processes. These challenges left Together generally unprepared for a major cybersecurity event.
Key challenges included the following:
Limited visibility into assets and operating environments. With limited visibility into assets and operating environments, the Together Housing team struggled to identify and quantify risk.
Low maturity of governance and risk quantification. Together struggled to quantify and communicate risk to its stakeholders. Without clear visibility into risk, the limited resources in IT spent an inordinate amount of time assessing and analyzing the environment and still struggled to report on actual risk.
Lack of security awareness, education, and culture. Security hygiene throughout Together’s diverse employee base resulted in frequent security events and created friction in program improvements.
Limited staffing. With no dedicated cyber resources, Together had little time to operationalize the security program. The manager and two lads on the team looked after the entire infrastructure, including servers, cloud, firewalls, and cybersecurity.
Siloed, point security solutions. Together used multiple siloed security solutions from multiple security vendors, and web filtering, phishing, VPNs, etc. were all separate. “It was almost impossible to trust,” said Curran.
With our move to Trend Vision One platform, we’ve reduced the number of siloed security tools by 70%, decreasing complexity in both managing tools and using them and simplifying the lives of our analysts.
TREND VISION ONE PLATFORM IN ACTION
Together reports that the adoption of Trend Vision One has enabled the organization to secure its rapidly growing fleet of devices, systems, infrastructure, and data sets within its diverse operating environment.
Trend Vision One supports both proactive and reactive security strategies, including reducing the attack surface, monitoring and assessing risk, and mitigating active threats. The platform consolidated multiple point security solutions to protect network, endpoint, email, and cloud infrastructure, while supporting security operations, including both proactive Cyber Risk Exposure Management (CREM) and reactive detection and response capabilities. Vision One CREM is helping to assess and quantify risk across the entire cyber estate.
Together is also utilizing Trend Service One for managed detection and response services, extending the internal team and providing expert security resources to monitor the environment 24/7.
"If you want to drive change, it can’t be just you paddling the boat. We needed to get everyone paddling together. Then you’ve got everybody singing the same song!"
Stuart Curran
Assistant Director for ICT, Together Housing Group
Together Housing Group reduced the number of siloed security tools they use by 70% after moving to Trend Vision One.
Assistant Director for ICT, Together Housing Group
Stuart Curran
BUSINESS IMPACT
Together reports significant improvements fueled by Trend Vision One across the entire security program:
- Visibility improvements. Curran reports drastic improvements in asset, risk, and threat visibility from Trend Vision One.
- Translation of cyber-risk into business risk. Curran reported that “Vision One enables our team to show up with clear data on issues. This enables us to address security issues with individual managers, who can then take action within their teams or with specific individuals with confidence. The risk scoring within Vision One makes it easy for managers to see and support our cybersecurity objectives.”
- Tools consolidation. “With our move to Trend Vision One, we’ve reduced the number of siloed security tools by 70%, decreasing complexity in both managing tools and using them and simplifying the lives of our analysts. This all translates into tangible cost savings on multiple levels.”
- Cost reduction. The Vision One integrated security platform has helped Together reduce or avoid costs in multiple areas as the organization improved its security program. As the attack surface and threat landscape have grown, Together has been able to scale up its cybersecurity program without adding more staff members. Direct costs would have been much higher had Together continued using separate point solutions for the threat vectors it was focused on.
- Audit and compliance readiness. Vision One helps Together both understand and communicate risk posture with auditors, regulators, and other service providers. Stuart reports spending less time and budget on compliance activities and being able to rely on some of his most junior staff to prepare for audits. Beyond compliance, the strength of its cybersecurity program and its ability to effectively communicate risk translates into reassurance for others, giving Together more buying power when it wants it (i.e., loans to acquire more housing, etc.).
CONCLUSION
Securing a highly diverse, not-for-profit housing association with limited resources and budget requires a carefully crafted balance of flexibility, trust, and compliance. IT and security leaders supporting this environment, therefore, need all the help they can get to see, protect, and defend this diverse attack surface while carefully monitoring risk to thwart operational disruption. Trusted partnerships with security solution providers such as Trend Micro are helping support security program growth and sustainability, strengthening security posture, simplifying security operations, and easing program management.
The deep and trusted relationship between Together Housing Group and Trend Micro continues to strengthen, enabling Together to focus on housing and service delivery, while operating a secure, performant environment that serves the many local communities it supports.
ABOUT TREND MICRO
Trend Micro, a global cybersecurity leader, helps make the world safe for exchanging digital information. Fueled by decades of security expertise, global threat research, and continuous innovation, the Trend Vision One enterprise cybersecurity platform harnesses AI to protect hundreds of thousands of organizations and millions of individuals across clouds, networks, devices, and endpoints. TrendMicro.com
Ready to transform your cybersecurity approach?