Heilbronn is a Landkreis (district) in the German state of Baden-Württemberg, located in the north of the state. Its largest city and district seat is Heilbronn. The district has a population of approximately 340,000 people and covers an area of 1,097 square kilometers. It is governed by a district council and district administrator, who are responsible for managing local services such as schools, social welfare, waste disposal, and road maintenance. The Heilbronn District is also home to many industrial and commercial enterprises and is an important transportation hub in the region.
The region is home to a growing and vibrant IT industry. The city of Heilbronn has established itself as a hub for technology startups and is home to several well-known tech companies. The region also has a strong research and development community, with universities and research institutes working on cutting-edge technologies such as artificial intelligence, machine learning, and the Internet of Things. Additionally, the district is investing in digital infrastructure, including expanding high-speed internet access, to support the growth of the IT industry and foster innovation in the region.
We spoke with Thomas Hauber, Team Leader of the Technology Division, for this case study.
With a large IT environment comprising a combination of vSphere, Windows, Linux and Citrix technologies, the Heilbronn team faced significant challenges in maintaining compliance with Germany's BSI IT-Grundschutz security regulation. They needed a software solution that could help them manage compliance proactively and save them time, which is where Runecast came in.
“We have a strong security policy of needing to comply with Germany’s BSI IT-Grundschutz security regulation,” said Mr. Hauber. “We needed a software solution to help us manage that compliance in a way that would not be reactive and would make their reaction and response times shorter.”
BSI audits were scheduled approximately every two-to-three years and – with limited monitoring capabilities – they were spending three-to-four months in preparing every time for these audits. It consumed lots of man hours and required too much paperwork (including preparation of an Emergency Manual). Despite those preparations, they needed frequent external health checks with their IT service provider. So they began searching for a solution that could provide automated security compliance audits for the BSI standard and would also be able to save them time.
“Runecast was the solution that we found that looked best for our team to save a lot of time,” said Mr. Hauber, “specifically because of any noncompliance with the BSI standard being clearly visible and even ranked by criticality.”
Runecast was the only solution they could find that provided the BSI coverage and automated security compliance audits that they were after for maintaining the team's ongoing BSI security posture. They started with a Runecast free trial, tested it and saw that it was exactly what they needed for a more proactive approach. With a deployment and findings that took less than a day, Runecast immediately identified security issues on ESXi hosts and VMs, making it easier for the team to remediate those issues within a few weeks, in coordination with their service provider.
What stood out for the Heilbronn team was the color-coded ranking of issues, their criticality levels, and the ease of use of the Runecast platform. They were also impressed by Runecast's later addition of VMware HCL upgrade simulations, which made upgrade planning easier.
“We decided that our solution would be to watch Runecast regularly for new scan results, analyze the findings and categorize those,” said Mr. Hauber, “and then work with our external service provider to remediate any new issues proactively.”
The Runecast platform provides the Heilbronn team with automated security compliance checks, vulnerability assessments, configuration management and more, to discover any issues that could endanger either physical or virtual environments.
Mr. Hauber shared, "Runecast finds and reveals vulnerabilities and misconfigurations for us proactively, before these can devolve into bigger problems for our team." The team, which was already incredibly efficient, can save an estimated additional 10-20% of man-hours on an ongoing basis.
Moreover, since implementing Runecast, the Heilbronn team has greatly reduced any incidents requiring external support, and their BSI security compliance audits now take much less time to prepare for. When asked about the aspects of using Runecast that continue to surprise them, Mr. Hauber stated, “Runecast continues to surprise us with its detailed remediation steps to implement and its overall ease of use.”
Mr. Hauber advises other companies considering Runecast to "implement the solutions slowly" and not to implement too many remediation solutions in one day. He also highlights that “Runecast helped us with overall time savings, especially toward achieving and maintaining our ongoing BSI security compliance, and we don’t need to contact our external service provider as often.”
Runecast has provided a solution that has saved the team time and allowed them to focus on other important tasks, making their job easier and more efficient.
“Runecast finds and reveals vulnerabilities and misconfigurations for us proactively, before these can devolve into bigger problems for our team. Runecast continues to surprise us with its detailed remediation steps to implement and its overall ease of use.”
Thomas Hauber
Team Leader, Technology Division
Run it... you will be amazed by the findings. We always think that a lot of applications are secure by nature and by how they’ve been designed, but after deploying Runecast you really understand the gaps that you might have in your environment and it’s definitely an eye-opener.
Vice President - Infrastructure & Security at Oman Airports
