Honey Baked Ham Secures Apps with No Interruption

The Honey Baked Ham Company is a leading American food producer and retailer, providing high quality products for families nationwide since 1957. Honey Baked Ham needed to improve the security posture of 45 critical applications that access sensitive customer information. The organization wanted to prevent unauthorized access to these systems and take more proactive steps to minimize the impact of potential breach incidents. Simultaneously, it was important that new protective measures not disrupt key business workflows. 

PCI-DSS compliance 

Honey Baked Ham is also subject to PCI-DSS compliance, which mandates (among other things) isolating specific assets storing, processing, or trans-mitting cardholder data. The company needed a segmentation approach that would ensure its compliance, reduce its risk levels, and protect its brand reputation if breached by preventing lateral movement of bad actors. 

Environmental factors 

The business needed to secure a mix of application servers and SQL databases running on both bare-metal server clusters and VMware virtual machines. Isolating individual applications in this heterogeneous environment using traditional techniques would require a substantial investment in new firewall appliances, as well as require many months of work. 

Firewall failure 

Initially, the business attempted segmentation with legacy firewalls. Unfortunately, the legacy firewalls fell short in terms of visibility and insight into activity in the environment, including communication flows between servers and applications. 

“With traditional tools, segmentation is extremely difficult,” noted David E. Stennett, Senior Infrastructure Engineer on the security team at the Honey Baked Ham Company. “How do you even organize what you’re going to divide into different segments? How do you know what needs to go with what, what’s talking with what, or if it needs other things talking to it?” 

The firewalls also did not provide adequate security controls or the granular segmentation that Honey Baked Ham needed. Moreover, the organization wanted a solution that offered threat detection and response capabilities to stop unauthorized activity, and this was not in the scope of what the legacy firewalls provided. 

Cost and time losses 

Another major factor in the organization’s change of approach was the fact that the legacy firewalls were expensive and required too much downtime to implement. In addition, the implementation process would consume three full-time resources.

“The cost of using traditional firewalls was going to be outrageous and the time was going to be more than the business wanted us to commit to,” said Stennett. In fact, the company’s effort to secure its applications was completely stalled by an untenable $1 million total price tag, two-year timeline, and downtime requirements. 

Microsegmentation saves the day 

InterDev, a partner, introduced the microsegmentation solution to Honey Baked Ham as an alternative to physical segmentation. 

Honey Baked Ham deployed Akamai Guardicore Segmentation software agents both on-prem and in the cloud. The granular visibility and application dependency mapping Akamai Guardicore Segmentation provided quickly showed how Honey Baked Ham’s applications communicated with other IT assets at the process level. The team was then able to use this data to map application dependencies and create software-defined boundaries around the business’ most sensitive applications. 

"I get real visibility and can actually see who’s connecting to what applications and servers,” said Stennett. “I have better and more control to segment, AND it’s cheaper? This is a no brainer.” 

Huge cost reduction 

With Akamai Guardicore Segmentation, Honey Baked Ham was delighted to reduce upfront costs by 50% by avoiding new firewall appliance purchases. Honey Baked Ham estimated that using software-based segmentation instead of legacy firewall appliances reduced the total cost of their application security initiative by 85%, from over $1 million to less than $160,000. 

Ease of use 

The simplicity of a software-based segmentation approach made it possible for one security architect to complete the entire segmentation project in a mere six weeks without any application downtime, a significant change from the previously estimated two years with the firewall approach. 

Since Akamai Guardicore Segmentation doesn’t require hardware and is independent from the underlying infrastructure, it was simple to manage. Honey Baked Ham easily developed and deployed policies that crossed all environments, on and off premises. As Stennett said, “With Akamai Guardicore Segmentation, I can see all that traffic in one place. I can see all my rules in one place. I can manage everything from one place.” 

Massive time savings 

“With Akamai Guardicore Segmentation, we were not only able to secure 45 applications without interruption in just six weeks, we also got a more agile, cost-effective, and secure solution than our legacy firewall provider,” said Stennett. Ultimately, Honey Baked Ham was able to accelerate implementation timeline by over 15x — without system downtime, infrastructure changes, or business disruption.