The Client
CanFirst Capital Management manages growth and income funds, investing in major Canadian markets as well as select secondary markets. The firm handles sensitive investor information and must be able to demonstrate that its security measures meet the expectations of limited partners and financial auditors.
The team behind Secure Managed Service has supported CanFirst since 2020.
The Challenge: An Aging Network That Could Not Support Remote Work
CanFirst relied on an aging in-office network, with an outside contractor handling IT issues as they arose. Its data was stored on-premises, while its remote server needed stronger security controls.
When the COVID-19 pandemic forced employees to work from home, the limitations of that setup became clear. Staff had no reliable way to access company files outside the office. Without an internal IT team to manage the transition, CanFirst needed help restoring access and securing its environment.
Security was also an important consideration for the firm's investors. CanFirst needed to demonstrate how sensitive information was protected whenever a limited partner or financial auditor requested assurance.
The immediate priority was getting employees working remotely. Beyond that, CanFirst needed an IT environment it could manage and secure as its operations evolved.
The Solution: Restore Remote Access and Extend Security Across Devices
The team approached the project in phases, starting with the infrastructure that prevented employees from working remotely.
The first phase moved CanFirst's on-premises network and data to the cloud. Completed in May 2020, the migration gave employees access to the resources they needed while working from home.
With remote access restored, the next priority was securing the devices and connections employees used to reach company information.
The team deployed Microsoft Intune with mobile device management (MDM) and mobile application management (MAM) policies. It also implemented modern hybrid identity, cloud-based identity and data protection, and Azure compliance controls.
Network security received similar attention. The team redesigned CanFirst's security zone and introduced intrusion detection, web filtering and malware protection. A secure SSL VPN provided protected remote connectivity.
Device onboarding proved more complicated than expected. CanFirst had allowed employees to purchase their own computers, which almost doubled the time required to bring devices under corporate management.
Mobile phones presented an additional challenge. Employees needed access to company information on their phones, but those devices also had to fall within the firm's security controls. The team worked through these requirements while supporting employees remotely.
As CanFirst's IT needs grew, the engagement expanded into a third phase. The team introduced a managed IT help desk to handle day-to-day support and ongoing system management.
The Results: Secure Remote Work With Ongoing IT Support
CanFirst moved from an office-dependent network to a cloud environment that supports remote work. Employees gained access to company resources outside the office, while Intune provided a way to manage devices and apply corporate security policies.
The security improvements also addressed the firm's obligations to investors and auditors. With device enrollment, identity protection and network security controls in place, CanFirst could demonstrate the measures used to protect company information.
The engagement has since grown beyond the original migration. CanFirst now has a managed IT help desk familiar with its systems and available to address everyday technical issues, allowing its internal team to concentrate on managing its investment funds.
CanFirst is a trademark of CanFirst Capital Management. The use of such trademarks, logos and brand names in this publication is for identification purposes only and does not imply endorsement.
