SA Water Moves to the Cloud, Securing APIs with F5

With over 160 years of history, SA Water is a leading government-owned utility in South Australia. It is dedicated to providing essential water and wastewater services to more than 1.8 million residents. Committed to effective water and wastewater management, SA Water embraces innovation and sustainability for the long-term viability of water resources in the region.

The utility’s aging digital infrastructure presented growing operational challenges. The organization previously relied on aging Citrix NetScaler appliances to manage load balancing and web application firewall (WAF) functions for critical applications. Unfortunately, these appliances were increasingly unable to meet the organization’s evolving needs. These appliances were costly to maintain and lacked the scalability required for the utility’s future digital transformation initiatives. This inefficiency led to higher operational expenses, reduced transparency in managing services, and a significant strain on IT and network teams, who were overburdened with routine hardware maintenance and upgrades. As a result, these teams found it difficult to focus on more strategic, high-priority initiatives for the business to innovate and improve service delivery for their consumers. 

Replacing appliances with similar hardware was not a viable long-term solution. SA Water needed a modern, future-proof approach that would enhance operational efficiency, while scaling to meet the growing demands of the business and simplify infrastructure management.

In addition to these challenges, SA Water faced increasing security risks related to its growing catalogue of APIs and cloud-native applications. The organization adopted the MuleSoft Anypoint Platform that was hosted on AWS to integrate disparate systems deployed across on-premises and cloud environments. However, this shift towards a modern cloud-first approach introduced new cybersecurity vulnerabilities with the increasing number of APIs in production, which were central to the utility’s operations. SA Water needed to implement a solution that would provide protection for their entire estate of APIs to defend its infrastructure from increasing cyberattacks that seek to target critical utilities.

Recognizing the urgency of the matter, SA Water sought a solution that would not only streamline network and security operations but also protect its API-driven MuleSoft environment. The ideal solution would offer simplified management, robust API security, and the ability to scale across hybrid and multicloud environments while future-proofing its infrastructure for long-term growth.

Migrating to the cloud was a crucial step towards modernizing SA Water’s infrastructure, and ensuring robust security of its evolving API environment was a top priority. After a thorough evaluation of various cloud-based solutions, SA Water selected F5 Distributed Cloud API Security for its superior architecture, ease of management, and ability to provide cloud-native, scalable security for the organization. 

As part of the evaluation process, SA Water conducted a rigorous proof-of-concept (POC) that included comprehensive penetration testing with over 25,000 simulated automated attacks. The platform’s default “out of the box” security policy successfully blocked the vast majority of these threats, with only 94 getting through. The SA Water security team worked with F5 to further fine-tune the security policy settings to ensure complete protection. This demonstrated the platform’s ability to quickly adapt to emerging threats and provided SA Water with complete confidence in the F5 solution.

Leelan Abeyarathna, Senior Technology Network Engineer at SA Water, says, “The flexibility of the F5 Distributed Cloud Platform, combined with native capabilities to secure our API environment, was a key factor in our decision.”

The choice to adopt F5 Distributed Cloud API Security also stemmed from the utility’s need for a more robust and agile solution that would seamlessly integrate with the utility’s multicloud strategy. While the MuleSoft option provided essential API management capabilities, the urgent need to ensure that the utility’s expansive API catalogue was protected made Distributed Cloud API Security with its flexible and scalable architecture more suitable for the evolving needs of the business.