Fortescue Metals irons out cloud security

Mining company looks to extract value from Office 365.

Listed iron ore giant Fortescue Metals has embraced Microsoft’s Office 365 as the company looks to continue its rapid growth without increasing complexity or IT support costs.

The company is growing at a phenomenal rate - extracting 100 million tonnes of iron ore in the past year. That growth is set to continue, according to Fortescue Metals CIO Vito Forte, with the company projecting to grow to six and seven times its current size.

Even at that growth rate, Forte has been given “clear targets to keep the total [staff] headcount down”.

This requires “astounding” degrees of collaboration between teams stretched thinly, he said.

At present, Forte has around five IT staff trying to manage Exchange 2007 and Microsoft Sharepoint servers which provide access to some 5000 staff.

“We’re not really keeping up, we can't move quick enough,” he told iTnews.

Forte said he would rather have his IT teams working on solutions that add value – such as business intelligence, application integration and operational systems - rather than the maintenance of messaging and office productivity.

“It’s great that [Office 365] is available,” he said. “It's a solution I have been looking for for six years.”

Forte has been in the Office 365 beta program and said he finds it easier and cheaper to run than the mining company’s internal systems.

“Given our need for speed, we will try and get everyone on board [on Office 365] in a three to six month timeframe,” he said.

Security concerns

Forte acknowledged that Australia’s mining sector has unique security concerns after a string of high profile cyber attacks in recent years.

He thinks the cloud – conversely to popular opinion – a more secure place than systems running on Fortescue’s premises in Perth.

The cloud is less risky, Forte said, because Microsoft “has more to lose” from a security breach.

“Security is a very high priority for us,” he said. “We are a very dynamic organisation, and we are more susceptible from that point of view.

"We have gone through fairly rigorous process with Microsoft. We issued a security document ten pages long, and all our questions came back answered.

"Everything you would expect at enterprise-level is provided.”

The Microsoft cloud offers SAS70 reporting, he said, and at least one audit per year. “It’s a level of reporting that far exceeds anything we can do internally.”

Fortescue Metals will have to keep Windows Server in-house to allow for single sign-on capabilities via Active Directory.

Forte said the company is looking forward to advances in information rights management to ensure that only the most critical data is subject to the highest levels of security.

“Only one percent of our information is the data we really don't want people to see,” he said.

The company is also considering a hybrid solution for senior executives requiring additional levels of encryption that would otherwise be difficult to provide via Microsoft’s cloud.