North of England Commissioning Support Unit (NECS)

The North of England Commissioning Support Unit (NECS) provides a wide variety of consultancy, products, services and support, including ICT services, to 25,000 NHS GPs in the North East, North Yorkshire, York, and Derbyshire.

NECS is engaged via the NHS' Clinical Commissioning Groups (CCGs) to bid for and deliver ICT services, consultancy, procurement support, application hosting, business intelligence products and services, business and clinical support, marketing and communications assistance and other important health and social care provision to general practices throughout the UK.

Head of ICT Infrastructure for NECS Graham Tye describes how Forfusion helped them to achieve tighter and more effective control of their network access across their whole client population:

Problem

"Our clients' use of IT is mission-critical," comments Graham. "They cannot afford any compromise in their IT service level and yet over such a large geographical area, we have little physical control over the devices at each practice location."

Outlining the problem, Graham says: "It's impossible to support 750 practices in person. Nor would clinicians want consultation hours to be interrupted by IT support personnel.

It's critically important that we control devices that are connected to our network... without this, our service's robustness, resilience and data security could be at risk from devices that are not managed by NECS or devices that are out of support."

Requirement

"With such a geographically disparate client base, we needed an efficient way of managing network control, security and access across the whole of our estate," says Graham.

"The ability to protect the network perimeter remotely was vital. Access control, authentication, device identification and policy enforcement are the normal building blocks for a robust IT platform.

We knew that we needed the Cisco Identity Services Engine (ISE) solution. We also knew that we needed technical expert help to implement the outcome we were looking for."

"I was aware of Forfusion in my professional network in the North East," explains Graham. "They provided NECS with excellent tactical support with Cisco issues and problems, so we knew they were very responsive and knowledgeable about the products."

Assess

ISE Project Requirements Gathering "Forfusion provided a very professional and personable service," Graham says. "They conducted a thorough investigation into our current infrastructure and took an iterative approach to producing the specification we needed."

Design

"Forfusion worked well alongside our technical team," says Graham. "With their product expertise and our organisational understanding, the joint team tackled the design effectively.

Having had experience in a previous role of the operational issues that can occur when ISE is set up incorrectly, I was very aware of the risks of poor design.

For example, with a poor set up, there's a risk of locking out legitimate users, which could raise a clinical risk in a clinical setting. Forfusion were essential in making sure we were deploying ISE safely," Graham asserts.

"They also brought forward the possibility of using ISE to authenticate users on the NHS public Wi-Fi that NECS deploy across all practices. This was an additional element in the design which gives us enhanced control over network access."

Integrate

Taking advantage of the project to improve network security and robustness across the GP surgeries, Forfusion were simultaneously able to enhance security and control within the data centre via the high-performance switches of Application Centric Infrastructure (ACI).

Commenting on this aspect of NECS' solution, Commercial Director for Forfusion Anthony McMenzie says: "The data centre servers accommodate the most sensitive data and ACI provides the virtualised infrastructure to understand the traffic, define rules and segment the data at network level.

Whilst ACI and ISE are not mutually dependent on each other; they are compatible infrastructures to deliver together. ACI is ISE for the data centre."

Operate

"ISE was remotely implemented in the data centre and all the location switches across the entire network," explains Graham.

"It was initially deployed in listening mode so it could gather information about normal network traffic.

Forfusion and our implementation team then worked together to activate ISE across all the locations. Once it knows what's normal, it uses that information to set the access rules and policies for the different devices. And once the rules are established, it can be switched on gradually."

NECS are now in a position to prevent alien (i.e., non-NECS managed devices) devices from being plugged into the network.

They can also stop inappropriately patched devices from getting onto the network, protecting it from operating system versions that are out of support. Commenting on the advantages this brings, Graham says: "The ISE implementation enables us to deliver our services more reliably, securely and effectively, improving network resilience and robustness and ensuring against outages.

ISE does a million different things and is a very clever and powerful gatekeeping platform. Forfusion are providing excellent training and skills transfer as well as third line support for our network teams to run ISE self-sufficiently in the future."

New Possibilities

"With more efficient service delivery and remote management capability ISE is an important enabler in our expansion to further geographical locations," says Graham.

"As all policy configurations can be handled from one place, this potentially speeds up service delivery."

Recommendation

"Forfusion are a very versatile ICT infrastructure partner," concludes Graham.

"They can help with hardware and services procurement, design, specification, licensing, training and support.

As a tactical problem-solver, they know Cisco inside out. They are very professional and accommodating and act as a 'comfort blanket' whenever we've got any thorny problems."