Energy giant upscales system security with multifactor authentication and passwordless access

Founded in 2005, DTEK is the largest private corporation in the energy industry in Ukraine. The company extracts coal and natural gas and generates renewable energy. It also trades energy products in Ukraine and abroad and supplies electricity to consumers. Hence, it is important that the company’s critical infrastructure and IT systems are operated securely. To facilitate this, DTEK embarked on an ambitious project of upscaling its security to a new level.

“We wanted to strengthen authentication in IT services for users with privileged access,” explains Denys Garkavyi, Head of IT Infrastructure Department at DTEK. Previously, DTEK IT admins used two-factor authentication, with tokens and SMS authorization. However, the team didn’t want to continue using SMS and passwords due to potential breaches. “For us, it was essential that our IT admins didn’t use passwords in the remote admin scenario. If passwords were stolen, that would compromise the whole IT system and lead to possible financial and reputational losses. We needed a more advanced technology,” adds Oleksii Morozov, System Infrastructure Architecture Expert at Infrastructure Development and Automation Projects, IT Infrastructure Department at DTEK.

Higher security and flexibility

Together with the technical partner Infopulse, the team considered two solutions: Azure Active Directory Multi-Factor Authentication (MFA) and passwordless login. Combined, they would meet DTEK’s security requirements and allow for various access scenarios.

Once the approach was chosen, Infopulse analyzed the existing IT infrastructure, designed the solution, and created test cases. “We tried making the test scenarios as granular as possible by taking into consideration user identity, user location, risk levels as well as the device platform and by using various available MFA and passwordless technologies such as Windows Hello for Business, FIDO2 tokens, Authenticator app, etc. The tests proved a successful secure access to Microsoft 365 apps as well as on-premises and cloud-based business applications such as SAP and customer relationship management platform,” says Nikolay Romantsov, Delivery Manager, Cloud Managed Services and Solutions at Infopulse.

“The combination of MFA with passwordless login increased the security level of privileged accounts. It was especially important for admins that accessed the system from outside a controlled environment,” explains Morozov. Now, DTEK can also control which logins should require two-step authentication. In addition, DTEK also created an access log, which has enabled the team to start collecting data on system entries. “We monitor the logins so we can further improve our security by cutting off connections from irregular locations,” says Morozov.

Now, around 200 admins and 2,000 business users access systems with MFA and passwordless login. “Employees no longer have to rely on on-premises access, but can work on mobile devices anywhere, anytime. It has ensured our business continuity,” adds Garkavyi.

In the future, DTEK will continue exploring various scenarios of integrating MFA and passwordless login to more business systems. “IT security in business is very important, and I believe we’ve taken it to the next level,” concludes Morozov.