70 Countries at a Glance

As a consequence of the company structure it is not possible to centralise the IT infra-structure with around 3500 client and 700 server systems completely. There are two important data centres at the headquarters, but the representations which are dispersed around the globe more or less work independently. As an example, some use their own Internet access because it is not possible to have a centralised communication due to possible transmission lags, and taking into account the consequences of the geo IP concept. Another reason is that KWS is not primarily active in the international metropolitan areas, but rather in rural areas where sometimes only a narrow-band Internet connection is available.

KWS has placed substantial parts of its operative IT with service providers. Some of these service providers only take care for one region, others for several regions. Activities of the service providers, and the IT systems, are controlled by 5 KWS-owned service cen­tres which are responsible for different regions: Germany, Western Europe, Eastern Europe, North America and South America.

This constellation requires a lot of organisational skills from the IT management and the security officers when it comes to checking the security status of the systems in the en­tire KWS network, to determining weak points and to rectifying them in a targeted way. KWS places a great deal of importance on a defined minimum security level for the IT because the results of its IT-based research and development are paramount for the market opportunities of this seeds supplier. In addition, global sales and the production control are closely interconnected with the IT systems, so confidentiality, integrity and availability of information and information technology have to meet high demands. Cur­rently, our IT systems do not have to comply with external compliance requirements, Andreas Sternberg, IT Security Officer at KWS, says, explaining the significance of the security levels at the company, but we define our own standards and have to find ways to enforce them internationally and to measure their success.

At staff level, KWS successfully employs staff members who are familiar with the regional culture and how best to explain the headquarters requirements to their fellow staff mem­bers and service providers at the various locations. However, there was no elaborate concept to solve the technical and organisational challenges of the global Security Level Management at the company. In particular, the process of the technical status determi­nation of the IT security was to be organised in a much more efficient way. We have been working with comprehensive Excel tables sent to us at regular intervals in order to have an overview of the existing IT systems and the installed software, but also of security tools, applied patches, virus patterns and other im­portant data, explains Sternberg, and he ad­mits: But this procedure did not offer us our desired direct access to the global status in­formation. The security team at KWS saw the risk that the gap between the actual security situation and the available data would widen with a growing company and its IT systems.

An important requirement for KWS was a sophisticated role management to access the status dashboards. This system specification was a result of the organisational special feature that possible defects in individual systems have to be solved at different KWS service centres and, in the end, with different service providers. Security Lighthouse of­fers a corresponding access control: Based on the definition of their role, every service provider will see exactly the area they are responsible for, and we can be sure that they are effectively informed about the current tasks, Sternberg describes the new situation.