Automation Starts With Data Control
When Ørsted began automating its network operations, deployment speed was not the first priority. The Danish energy company initially needed to bring its network data under control and establish processes that would consistently meet security and compliance requirements.
João Soares, lead IT security consultant at Ørsted, found network information spread across several places:
Platforms without APIs
Systems whose APIs were not well suited to automation
Excel spreadsheets maintained through manual updates
Engineers regularly moved between these systems, copied information, and updated spreadsheets. Before reliable automation could begin, Ørsted needed accessible network data, granular permissions, and controls over how that data could be changed.
“It’s all about the data, starting with a solid foundation—a flexible data platform where you can build your own validation,” Soares said.
After assessing commercial and open-source alternatives, the company selected an open-source network automation platform. Ørsted then developed custom validators to control incoming data and applications that modeled concepts specific to its architecture, including network zones and their associated policies. This connected resources such as IP addresses to the policies governing them.
Why Firewall Changes Exposed the Problem
Firewall rule management was one of the first processes Ørsted targeted. The original workflow crossed multiple teams and systems:
An internal customer submitted a request through ServiceNow.
A network security engineer checked IP addresses, fully qualified domain names, and directory groups.
Depending on the request type, it went to the change advisory board for approval.
After validation and approval, another team implemented the firewall rule.
If a problem appeared at any stage, the request returned to the customer and the review started again.
According to Soares, these loops could continue for days or weeks. The teams were already operating at capacity, and simply streamlining the manual process would not remove the need to validate incoming requests.
Many of those checks, however, were suitable for automation.
Compliance as an Automation Requirement
The Ørsted case reframes automation as a control mechanism. Instead of relying on every participant to remember and interpret each requirement, the workflow can require valid data and apply the relevant checks consistently.
“The only way you can 100% ensure that it’s always compliant, regardless of who does the task, who’s involved, is if the process is automated and the automation forces you to be compliant,” Soares said.
This approach connects three operational concerns that are often handled separately:
Configuration control: Automation depends on trusted, validated infrastructure data.
Firewall change traceability: Requests, checks, approvals, and implementation need to form a coherent change record.
Compliance workflows: Policy must be part of the process rather than a review added after deployment.
The goal is not automation for its own sake. It is to make the approved process the easiest—and most consistent—process to follow.
How ConnectMyAssets Helps
ConnectMyAssets provides an on-prem, vendor-agnostic foundation for applying the same principles across multi-vendor infrastructure.
Dynamic CMDB centralizes asset, addressing, and infrastructure data so automation can work from a controlled operational view instead of disconnected spreadsheets.
Firewall Management brings firewall operations into the broader infrastructure-management process, helping teams connect changes with the assets and policies they affect.
Backup & History preserves configuration versions and supports one-click rollback. Before-and-after configurations can provide device-side evidence of what changed.
Compliance Engine evaluates infrastructure against requirements including NIS2, ISO 27001, PCI, CISA, and NIST, allowing compliance checks to become part of routine operations.
Automation & ZTP helps teams execute repeatable changes across vendors rather than depending on individual copy-and-paste procedures.
Credential Vault and SSH Bastion support controlled administrative access when automation or engineers interact with managed assets.
Together, these modules can connect infrastructure data, configuration history, firewall operations, and compliance findings. That gives network teams a practical path from a requested change to its implementation evidence—without requiring all infrastructure to come from one vendor.
Source: Network World
