Written by Wouter Avondstondt

NMBS-SNCB

Long-standing collaboration guaranteeing cybersecurity

‘A strong focus on security, the staff’s unique expertise, and a down-to-earth approach: that’s what makes Toreon stand out!’

NMBS-SNCB as a company needs no introduction; the Belgian National Railway Company is one of the most well-established brands in our country. NMBS employs over 19,000 people, and in 2019, a staggering 253 million domestic railway passengers made use of its services, be it for leisure or the daily commute. NMBS-SNCB’s large-scale operations and its sizeable clientele imply that the company needs to process huge amounts of employee and customer data each day. Being the Chief Information Security Officer (CISO) at NMBS-SNCB, Tim Groenwals is fully aware of the potential dangers there are when it comes to securing those enormous data pools. Groenwals’ long-standing collaboration with Toreon, however, offers him, his staff, NMBS-SNCB, and its customers that much-needed safety guarantee.

Expert Assistance

GRC Coaching

Data Protection

Like no other, NMBS-SNCB is aware of the cybersecurity pitfalls organizations may come across: in 2012, the company was faced with a substantial breach of security, which resulted in unauthorized disclosure of data. Considering his ample experience in the field of cyber- & information security, Tim Groenwals was appointed as CISO at NMBS-SNCB in 2013. More specifically, he has been working for Ypto, which functions as the railway company’s partner for all things related to IT. Groenwals directs his teams – consisting of about 40 people – in identifying, developing, and maintaining the general vision and strategy of various cyber- & information security-related policies and procedures, as well as the correct implementation of both. Their ultimate goal is to ensure NMBS-SNCB’s information assets and technologies are adequately protected and to reduce information and IT risks.

Saying that, in his capacity as the NMBS-SNCB CISO, Groenwals has a full plate is quite the understatement: covering the inherently complex field of security means that he is responsible for everything from the company’s cyber- and information security to IT risk management as well as privacy, i.e. data protection. Considering the complexity and diversity of the matters at hand, not all knowledge and expertise required was readily available in-house. Therefore, Groenwals went on the look-out for a partner who does not only have sufficient experience in the field but also employs people with the necessary expertise who would be able to help him both design and execute new policies. A reliable partner is crucial, Groenwals adds, “People with those skills don’t just grow on trees, you know!” Fortunately, NMBS-SNCB found that reliable partner in Toreon.

High-level IT skills

Groenwals’ working relationship with Toreon and its staff have been long-standing; it even goes back to his professional activities prior to his career at NMBS-SNCB. While working together, it did not take long for Groenwals to pick up on Toreon’s accomplishments in a number of very distinct areas, including privacy, cyber strategy development, and cybersecurity.

Subject to public tendering, NMBS-SNCB relies on other partners as well, which offer comparable services. However, Groenwals adds, “the fact that the market is ever-changing has a huge effect on the skilled workforce those companies need.” Nowadays, people are drawn to companies offering a sustainable work-life balance and a strong brand identity, rather than just a corporate image or a considerable paycheck. He continues: “Currently, there is a lack of professionals with the necessary high-level IT skills out there on the labor market. But this is where, in my opinion, Toreon can make a difference.”

‘Toreon’s services are key in maintaining the level of trust NMBS-SNCB customers have come to expect from us’

Tim Groenwals – Head of IT Strategy, Enterprise Architecture, Network & CISO
@ NMBS-SNCB

Down-to-earth approach

Not only is Toreon currently one of the only Belgian companies dedicated solely to security, Groenwals believes that, even though Toreon is a smaller SME, but it has also managed to hire the absolute cream of the crop in terms of cyber- & information security experts.

Apart from Toreon’s strong focus on security and its staff’s unique expertise, Groenwals praises the company for its down-to-earth approach to the issues at hand. The benefit of being rather small in size, is the lack of empty marketing: Toreon will always zoom in on a problem with a very practical, pragmatic attitude – they simply get to the point and get the job done. Another advantage of being a smaller company Groenwals notices is the fact that they are very agile; Toreon is quick to respond to different circumstances. Moreover, it uses methods that value human communication and feedback, and that can easily adapt to change.

Multidisciplinary team of experts

To this day, the most comprehensive and important task Toreon has taken upon itself for NMBS-SNCB was preparing the company for the General Data Protection Regulation (GDPR), i.e. the rules concerning data protection and privacy in the European Union, which was implemented in May 2018. Therefore, in the years running up to that date, Toreon had assigned a multidisciplinary team of experts in jurisdiction, information security, and project management. It was their job to analyze, design, and implement all necessary security measures, so NMBS-SNCB and its branches could become fully GDPR compliant. Groenwals looks back on this particular project concerning DPO (Data Protection Officer) services as Toreon’s biggest achievement for NMBS-SNCB thus far.

Toreon is involved in ethical hacking of the NMBS-SNCB site, apps, and every newly-developed technological innovation, thus exposing potential vulnerabilities in the software. At the moment, for instance, Toreon is working with NMBS-SNCB to expand its login possibilities, in the safest way possible. Furthermore, Toreon is involved in several smaller projects, e.g. analyzing the allocation of elevated rights and security audits.

Although the collaboration with Toreon will not lead to a direct increase in ticket sales, Toreon’s behind the scenes work actually does greatly impact NMBS-SNCB and its customers. Groenwals explains, “Thanks to our collaboration with Toreon, I sleep more soundly at night; both our company and our clients are guaranteed a safer environment to work, live and travel in.” According to Groenwals it is clear: “Toreon’s services are key in maintaining the level of trust NMBS-SNCB customers have come to expect from us.”