Zero trust joins tender evaluation criteria
Cybersecurity requirements are increasingly shaping the outcome of major infrastructure contracts according to Downer, which says customer tenders now include questions about cyber maturity and zero trust practices that were virtually absent five to 10 years ago.
Aidan Turner, Downer head of security engineering and platforms, says security controls once viewed as internal IT concerns are now directly influencing bid responses, compliance obligations and the ability to mobilise new projects.
“There were no barbarians at the gates… It’s just compliance for our contracts and for risk.”
“The people who are winning and responding to RFIs in the business are now seeing this in customer sheets that have come through and the bids,” he said at Gartner IT Symposium recently. “It forms a big part of our tender process and identifying where we can meet the needs of our customers and regulators.”
The commercial stakes can be significant. Turner says some customer contracts carry substantial financial penalties for down time. “It’s quite extreme in some cases, like six figures every 15 minutes for certain outages.”
Those obligations have elevated the importance of cyber resilience, access controls and system availability.
The shift has become so noticeable that cyber terminology once confined to security teams is making its way into mainstream business discussions.
“A couple of weeks ago I had one of our commercial people reach out and say ‘Aidan, we do zero trust, right?’” he says. “I had to pinch myself and say ‘I’m sorry, who taught you that word?’”
For Downer, the growing commercial importance of cybersecurity was brought into sharp focus during the mobilisation of a major new customer contract earlier this year.
“We had a new contract that needed to mobilise very, very quickly, and that particular customer was extremely strict,” Aidan says. “Our commercial team decided not to pass on some very key maturity level two requirements,” he says, referring to the Australian Signals Directorate’s mid-tier baseline of the Essential Eight.
It was that compliance for contracts that drove Downer’s increased cyber focus – and implementation of ThreatLocker for the required application control – rather than a major security incident.
“There were no barbarians at the gates. There wasn’t any sort of crazy incident that drove this adoption. For us it was pretty bland. It’s just compliance for our contracts and for risk.”
From 1,000 admins to fewer than 100
Meeting those requirements is particularly challenging in a business that operates across critical infrastructure, utilities and industrial environments.
“Our company does a lot of work with operational technology, a lot of proprietary, very old software and hardware,” Turner says. “When you have to interface with those bits of equipment, you need to have local admin on your device, you need to have proprietary software on your device that you can’t control or you can’t touch.”
That reality created a tension between operational needs and security objectives.
“When it comes to giving those people full control over their device, that’s very uncomfortable. But it’s something we had to live with until the beginning of the year.”
Downer has aggressively reduced privileged access and local administration permissions across its workforce.
Five years ago the company had over 1,000 local admins. “Now we’re well under a hundred,” Turner says.
The company has also dramatically tightened the process for approving elevated access requests.
“Rather than just assigning it because people think they need it, it’s a proper analysis,” he says. “One in every 40 requests ends up going through to the keeper. Thirty-nine are either rejected outright or a ThreatLocker policy is implemented to remove the need for standing local administrative privilege.
“It is just a transformation.”
The project also exposed a gap between assumed and actual technology use across the organisation.
“We saw some pretty shocking things,” Turner says of what was found in the environment. Among them: Third-party VPNs, Xbox, ‘all sorts of things’.
The challenge is unlikely to get easier. While Downer continues to tighten controls around privileged access, it is also facing growing demand from the business for new technologies and AI tools.
“Our business is very bullish on the AI stuff,” Aidan says. But many of those tools require levels of device access and flexibility that sit uneasily alongside the company’s security objectives.
For infrastructure operators, balancing those competing priorities may become the next test of cyber maturity.
