How Northern Rockies Regional Municipality Transitioned to a Zero-Trust Enabled Work From Anywhere Environment with Agilicus AnyX

Challenges

Stepping back to reconsider and rethink after the sudden surge of pragmatic decisions made at the start of Covid- 19, Northern Rockies realized they had several key challenges to switch from “make it work” to “make it right” on the next phase. Reverting to pre-2020 became apparent as a non-option, meaning anyone can work from anywhere is the new norm.

Some specific challenges that came out of this realization include:

Controlling Risk

Usability & Efficiency

Network Limitations

Equipment Limitations

Ensuring Compliance

Point Solution Cost

“We had fairly tight control of applications and communications methods, now we are opening up RDP and putting up a paved highway into our network.”

Controlling Risk: Being geographically remote means nothing for cybersecurity risks – everybody is just a ping away on the Internet. When Northern Rockies transitioned from all on-site to Work From Home during Covid-19, their risk profile instantly went from low to high instantaneously. Skillsets, budgeting, and staffing did not move at the same speed. They remained a small municipality with stretched budgets. Applications formerly only on-premise with known people using them locally suddenly had a much broader attack surface possible.

Municipalities were investing in insurance as a means of reducing the financial exposure, but changes in the insurance landscape were catching up. In order to be insurable, you had to control the risks.

Key challenges in controlling the risk included items that Northern Rockies did not yet have in place:

Strong identity & authentication of staff, vendors, and contractors

Multi-factor authentication

Tighter access controls than a VPN could achieve to reduce blast radius

Usability/Efficiency: Expanding the envelope of IT support into staff homes and personal devices was not sustainable. The resources were inherently on-site, on premise. And some of those resources were not going to change any time soon (tax, payroll). Northern Rockies needed a means for task-workers to use the resources they needed, from the location they were at, in a way that the IT team could manage and support. The solution needed to be something that was simple and familiar to these workers, and not require major changes to workflow or retraining.

Networking Limitations: In the summer of 2024 Northern Rockies experienced unprecedented wildfires. These fires impaired the communications infrastructure. Key critical infrastructure, including the water treatment plant needed ongoing maintenance, but it was unfair to ask staff to go and live there during a period of evacuations.
Northern Rockies acquired a satellite internet system to solve the telecommunication infrastructure, but found that it could not work with VPN technologies since it did not have a public IP nor the ability for inbound connectivity.

Legacy Applications and Equipment Limitations: Like many municipalities, workflows around email and shares had grown entrenched. Smart devices including printers and copiers were often left out of the cloud services due to lack of consistent identity and authentication. This created needless toil for the staff using them. In the case of Northern Rockies, there was a new copier that could not integrate with their Box.com cloud service, forcing staff to swivel-chair data.
A key budgeting tool also proved difficult to use. It could work via Remote Desktop, but then each user needed a remote desktop machine to log into. Theoretically it could work remotely, but its use of a share hindered this. The application proved too slow to use natively over a VPN due to network latency.

Compliance: Northern Rockies had found during their risk evaluation that multi-factor authentication was going to be required, and had specific applications that didn’t natively participate in any form of modern identity or authentication. CISA (Critical Infrastructure Security Agency) shows that implementing multi-factor authentication makes you 99% less likely to be hacked.
The idea of selecting, implementing, training, operating a multi-factor authentication for all first and third party users for all applications was seen as too expensive in both time and money for the limited resources of the company.

Point Solution Cost: Existing point solutions included web-based HMI access for their SCADA environment were proving difficult to maintain and expand. The overall implementation and operation cost of the various point solutions was hard to manage at the pre-Covid scale, and expanding that strategy to all applications and users was outside the scope and budget available.