As one of Australia’s largest automotive retail groups, Autoleague relies on secure, efficient IT systems to keep its nationwide operations running smoothly. Ian Melton, Head of Security & IT Operations, Autoleague, tells us how deploying BeyondTrust’s Privileged Access Management and Privileged Remote Access solutions has strengthened cybersecurity, streamlined remote access and supported business growth.
In a country the size of Australia, car ownership is a vital part of daily life for many people. To select a vehicle that suits their requirements, most would-be car owners rely on a dealership where they can compare models, take test drives and select from a range of optional extras. Following a purchase, the dealership can also provide after-sales support and mechanical servicing.
Driving Australia
Autoleague is one of Australia’s largest automotive retailer groups. It has more than 60 franchises across the nation where 2,000 staff sell more than 60,000 cars each year, generating revenues of around US$3 billion.
The group covers all aspects of car ownership and mobility through both new and used car showrooms and a network of after-sales service locations. As well as cars, Autoleague also deals with boats and motorcycles.
A secure platform to support business operations
To support its national network of car dealerships, Autoleague relies on a sophisticated information technology platform which supports everything from stock management and ordering to administration, parts inventories and support.
The platform also serves an administrative team in Sri Lanka that undertakes back-office tasks. The team needs to have reliable and secure access to Australian-based IT resources without requiring complex networking technologies or relying on virtual private networks (VPNs).
Deployment of Privileged Access Management (PAM)
To ensure the platform remains secure at all times, and to comply with complex cyberinsurance requirements, Autoleague realised it had to improve the way it was managing admin and user passwords.
“We needed a way to separate admin logins from daily logins to reduce the likelihood of unauthorised access to the IT platform,” said Ian Melton, Head of Security and IT Operations, Autoleague. “We also recognised that persistent passwords are regarded as a security risk and needed to be removed from use.”
After examining alternatives from a range of security vendors, a decision was made in 2022 to deploy BeyondTrust’s Privileged Access Management platform. This has allowed Autoleague to adopt the concept of automatically rotating passwords which significantly improves security without being onerous for users.
In addition, Autoleague leverages the BeyondTrust solution to automatically vault, rotate and secure local admin account credentials, removing any need to deploy and manage LAPS for break-glass accounts (used, for example, to repair broken Domain trust relationships on roaming devices).
The need for Privileged Remote Access (PRA)
Another challenge faced by Autoleague was created when a back-office support team was established in Sri Lanka.
“We needed to have a way to let the Sri Lankan team have secure access into our Australian platforms,” said Melton.
The challenge partly stemmed from the fact that the team was based in an office building that had a shared Internet connection. Autoleague therefore needed a secure tunnel that would allow the staff to access the resources as required.
A decision was taken to deploy Privileged Remote Access (PRA) capabilities from BeyondTrust. Once functional, the tool ensured there was a secure connection for staff in Sri Lanka. They can also work either from the office or from home while retaining strong security.
Ian Melton, Head of Security and IT Operations, Autoleague, said: “Thanks to BeyondTrust, we now have in place industry-leading password and access management capabilities.
“This ensures our core systems remain protected but also readily accessible to those who require it.
“The result is that we can offer support to our national network of franchisees who can meet their client’s needs.”
A further use of the Privileged Remote Access capabilities has come during the due diligence phase of acquisitions. Autoleague has used PRA to be able to secure connectivity to the acquisition’s company network to share information without the risk of malware or other cyber-risks coming back through the connection.
“It is often an overlooked part of the process,” said Melton. “There is the onus on us to protect our resources and systems while conducting our due diligence.”
Keeping the wheels turning
Melton said: “BeyondTrust has proven to be a solid vendor with a great product portfolio. We were looking for a vendor who could cover our requirements for both Privileged Access Management (PAM) and Privileged Remote Access (PRA) capabilities, and BeyondTrust has industry-leading products in both categories. They took the time to fully understand our needs and ensured the deployments added real value to our operations.
“With both PRA and PAM solutions in place, I am confident we have a secure, robust environment that will support our franchisees as they grow. Our password management processes have improved significantly and our oversees teams enjoy dependable, secure remote links.
“There are many security vendors from which you can choose, however BeyondTrust stands out because it has strong solutions in both the PAM and PRA spaces. I look forward to continuing to work with the company as a trusted technology provider.”
