Summit Utilities accelerates identity security & governance with Linx

About Summit Utilities

Summit Utilities is a natural gas utilities company that serves 650,000 customers across six states and continues to grow. Chief Information Security Officer Aaron Ballio oversees the company’s cyber initiatives and strategy, and is directly in charge of security operations, governance, risk and compliance, and identity and access management.

The challenge

Aaron and his team determined Identity governance is a priority. With the explosion in human and non-human identities, and the rising number of breaches, security teams are often asked to manage both the security posture of the identity perimeter as well as govern access on an ongoing basis.

“The problem is a scale problem. We have hundreds of users across hundreds of applications and really only one or two people to try to do those access reviews among all the other tasks that they have.”

Manual processes and limited automation made it hard to keep privileges aligned with roles, especially when employees changed positions. Often privileges can follow users to new roles without the system noticing, increasing risk over time.

The solution

Drawing on past experience, Aaron ruled out legacy IGA platforms that are large and difficult to implement. The team focused on a platform that addressed specific needs: access control, access reviews, risk management, and automation from the platform.

“I knew I didn't want to go to some of the legacy IGA vendors. They were very large, very difficult to implement. I just knew that that wasn't going to be the right fit for our organization.”

“That's when we came across Linx. Linx addressed all of those use cases and more, and we were able to get up and running within a matter of weeks.”

That led Summit Utilities to Linx. The team deployed Linx and was up and running within weeks. With Linx, Aaron’s team began shifting access reviews to supervisors and data stewards. The people closest to the work could verify who needs access to which systems, which reduced the manual burden on the security team and created clearer ownership for access decisions. When risky accounts are identified, the team can remediate directly in the platform.

“Now we're training our supervisory staff across the organization to take care of their own access reviews. They know what systems their teams need access to. We can have the data stewards also look at people who have access to their systems that they are managing. And that alleviates the burden from my team of having to do this manual process.”

Day one impact

Linx delivered value immediately. On the first day, Summit identified guest accounts that had been active for too long, stale accounts that were not removed when they should have been, and other risky accounts with too many privileges. This gave the security team actionable insight on identities right away.

“First day -  we were able to identify guest accounts that have been there too long, stale accounts that weren't removed when they were supposed to, and other risky accounts, too many privileges. So instantly we had some actionable insight that we could take on our identities.”

Outcomes in weeks

Within weeks, Linx helped kickstart and accelerate Summit’s identity governance program. The team quickly identified risky accounts and risky privileges, and began automating remediation. By distributing access reviews to supervisors and data stewards, Summit reduced operational bottlenecks and improved review quality. When a guest account is identified, remediation happens directly from the platform.

“Linx Security has already had a huge impact on our identity governance program. In a matter of weeks, we've been able to quickly identify risky accounts, risky privileges, and be able to automate the remediation of all of those things.”

Aaron's advice to peers

“My advice to other security leaders would be to take that time to take a step back and analyze what your use cases are. You will find that if you know your use cases, you can match the tool to those use cases instead of buying a very large product with endless customizations and difficult implementation. That's been our experience with Linx. It directly addressed use cases that we were experiencing without making it overly complicated.”