CASE STUDY
For more than a decade, we’ve supported Crest Nicholson, a leading builder of high-quality and sustainable homes in the UK, with the advancement of its IT strategy. A forward-thinking organisation with a focus on resilience, Crest was keen to reduce its overall attack surface and address the number of vulnerabilities reported across the business through our vulnerability scanning service.
They engaged the Security & Assurance area of the Advania Network & Security Operations team to deliver an expanded vulnerability management service.
With an established reputation and a commitment to maintaining exceptional standards across customer engagements and internal processes, Crest Nicholson sees its ongoing resilience and cyber security strategy as critical to its success.
Central to this is the ongoing detection and resolution of vulnerabilities across a circa 650-strong device estate that is the foundation of its operations. Determined to reduce the number of vulnerabilities being detected and reported each month as part of our existing vulnerability scanning service, Crest sought to engage expert external support to help work towards its wider goal of zero vulnerabilities.
Industry:
Housing
Service:
Vulnerability management
While regular vulnerability scanning was helping to detect potential areas for exploitation across the IT estate, Crest was concerned about its own capacity to resolve and reduce its attack surface and mitigate these incidents, especially in light of its long-term goal of reducing total vulnerabilities to zero.
With internal teams dedicated to other priorities and, in some cases, lacking the in-house expertise to resolve issues without additional third-party support, Crest looked to us as an existing partner with an experienced team for assistance with vulnerability resolution.
Building on our vulnerability scanning service, we developed an end-to-end vulnerability management service. Leveraging a combination of automated patch management through tools like Microsoft Intune and Qualys alongside focused, human-led resolutions delivered by a highly-skilled and tenacious team, this service closes out vulnerabilities that occur from inconsistent configurations, outdated software versions or new patch deployments.
Where resolutions cannot be actioned directly, our Security & Assurance team works directly with resolver groups within other areas of Advania, Crest’s internal teams and other 3rd party suppliers to manage vulnerabilities through from identification to resolution before they cause an issue.
Through regular stakeholder meetings, Crest are kept apprised of the current state of the environment and are given a platform to shape and tailor the service and reports based on their needs – a collaborative approach that ensures the service continues to deliver maximum value as requirements and priorities shift.
By delivering a consistent and joined-up detection and resolution model, we’ve reduced Crest Nicholson’s vulnerability exposure dramatically. From an average of over 2 vulnerabilities per device before the service started in 2022, Crest’s IT estate now averages less than 0.05 vulnerabilities per device and has come close to recording 0 vulnerabilities on several occasions.
With our vulnerability management service proving successful at reducing vulnerabilities across Crest’s device estate and server footprint, they’re now looking to extend this service to include key areas of network infrastructure to further enhance the ongoing level of resilience.
Paul Blair
Head of IT Operations
