The Norwegian Refugee Council (NRC)
NRC is an independent humanitarian organization that assists people fleeing conflict and persecution. They advocate for their rights, disseminate knowledge, alert about injustice and emergencies, and influence world leaders to respect their rights. NRC has 7,500 employees worldwide, with the majority working locally where their assistance is needed, and a small percentage based at the headquarters in Oslo.
A secure cloud platform
The Norwegian Refugee Council utilizes many of Microsoft's services such as Office 365 and Active Directory in their daily operations. They required seamless integration between these services and placed high demands on security. Therefore, the choice of Microsoft Azure as the cloud platform was natural. Microsoft Azure ensures the security of physical data centers and controls access to data. However, it is the user's responsibility to implement appropriate security controls and utilize security services to keep data and applications safe. Cloudworks was engaged to assist NRC with this task.
Cloudworks’ Cloud Security Maturity Model
Initially, it was important to understand the needs of the NRC and gain a comprehensive overview of the organization's existing level of security controls. Cloudworks conducted a GAP analysis and assessed the customer's security maturity according to Cloudworks' Cloud Security Maturity Model. The model identified NRC's current level and provided a solid foundation for planning the development towards a mature security model.
Cloudworks’ Cloud Security Framework
Based on the assessed level of security maturity and the needs of the Norwegian Refugee Council (NRC), Cloudworks implemented the Cloud Security Framework, a framework for cloud security. This framework includes recommended configurations of Azure for NRC's services, security requirements for aspects such as networking, data storage, role assignment, access control, certificates, encryption, logging, and incident response.
A robust foundation for further development
Cloudworks also assisted the NRC in developing internal knowledge about the Cloud Security Maturity Model and Cloud Security Framework. This helps NRC to onboard existing and future applications with less concern about which security measures to employ. They thereby strengthen their own security maturity, tailor the security strategy to their needs, and continue to develop services securely in Azure.
When we were starting up to run services in Microsoft Azure, it was crucial for us to get it right from the outset. With assistance from Cloudworks and their Cloud Security Framework, we now have a framework that scales well while retaining control over the various services and third parties.
Mads Grandt, Specialist Adviser Global ICT Operations i Flyktninghjelpen
