Fortum’s Zero Trust Adoption Journey: IT/OT Convergence and Strategic Business Drivers
A presentation at IDC Security Helsinki in in Helsinki, Finland by Bruno Amaro Almeida
Fortum’s Zero Trust Adoption Journey IT/OT Convergence and Strategic Business Drivers Bruno Amaro Almeida VP, IT Operations September 2024
Enabling Fortum’s transformation and success through efficient use of data and digital solutions Generation, Trading and Asset Optimization District Heating, Recycling & Waste Consumer Solutions Enterprise 2 … … Innovation & Venturing
IT STRATEGIC PRIORITIES Customer Centric Cost Efficient Secure and Reliable
Definitions “Zero Trust is a security strategy that verifies, uses least privilege, assumes breach, and authenticates every request. It applies to six foundational elements: identities, endpoints, data, apps, infrastructure, and network“ Microsoft
5 source: microsoft.com
Which type of IT project is a Zero Trust Adoption? 6 Cyber Security Employee Digital Experience Network & Connectivity Infrastructure & Platform
To SSE or not to SSE? • Microsoft Windows 10 out of support in Oct 2025 • Fragmented as-is state with multiple remote access tools and methods • IT vs OT environments As-is Remote Access OR NOW DECISION POINT Traditional VPN LATER OR SSE 7 Photo by Vladislav Babienko on Unsplash
Why we started the Shift to Zero Trust / SSE? • • • Simplify our existing network complexity (less tools) Lowers operational overhead in infra (network, on-prem and cloud) and workplace management services Enables a seemless experience regarless if you are: • using Windows or other OS • internal/external employee (BYOD) • Opens possibilities for seamless IT/OT remote access • Cost Efficient Secure and Reliable Significant direct cost savings within 3y Lower risks with zero trust principles Customer Centric Organization Renewal Improved UX for employees and partners Momentum for change • • Minimizes attack surface and prevents lateral movements (app segmentation) Easier to meet multiple compliance requirements (e.g. NIS2/CER) Enabler for the change we (IT and business) wanted to see in the organization
Our Zero Trust Adoption Journey OT access and privileged remote access enhanced OT use-cases and automation Internal and External Browser based Access extended remote access, priviledge access mgmt, combine experience with operational data Remote access for “office use” (Windows 11 Readiness) Employee remote access, virtual desktops and hardware Photo by LOGAN WEAVER | @LGNWVR on Unsplash
10 source: zscaler.com
Lessons and Key Considerations Employee Personas and Developer Experience 11 Mergers, Acquisitions and Divestments (MAD) Platform Engineering and Automation Capabilities
Questions & Answers Bruno Amaro Almeida VP, IT Operations brunoamaro.com
Fortum has embarked on a comprehensive Zero Trust adoption journey, redefining its approach to security across both IT and OT environments. This session will delve into our experience, highlighting the convergence of IT and OT—a critical factor in enhancing security and operational resilience. We’ll explore the business drivers behind our Zero Trust adoption, including the need for enhanced security and reliability, adherence to stringent compliance requirements, and the pursuit of cost efficiency. Additionally, we’ll discuss how a Zero Trust framework improves digital experiences for users by minimizing trust and verifying every request as though it originated from an open network.
Key lessons learned include the importance of a phased approach to implementation, the necessity of cultural change within the organization, and the value of continuous monitoring and risk assessment. We’ll also share considerations for overcoming challenges such as integrating legacy systems and ensuring stakeholder buy-in.
Code
The following code examples from the presentation can be tried out live.
