Our case studies offer insights into real client projects, including security measures aligned with the ICT minimum standard. They show how our solutions perform in everyday operations: transparently, at scale and reliably. We describe the initial situation, the requirements and the implementation, and then demonstrate the value achieved through concrete results. This provides an authentic picture of how different organisations deploy modern IT and security solutions. We also thank our clients for their trust and their willingness to share their experiences publicly.
With Lamprecht Transport AG, we show how a Swiss logistics provider systematically secures privileged access and protects itself against insider attacks. The federal ICT minimum standard serves as the reference framework. The focus is on the move to a tiered administration model, Privileged Access Management with automatic password rotation, and comprehensive monitoring of user actions by internal and external administrators. Furthermore, we explain how the recorded metadata feeds into the SOC provider’s analysis via Syslog. We also show how these measures map to ISO/IEC 27001 and the revised Federal Act on Data Protection.
About Lamprecht
Headquartered in Basel, Lamprecht Transport AG is an independent Swiss family business. It has provided tailored transport and logistics services since its foundation in 1945 and is now managed by the third generation. The company employs over 300 people, with branches in Basel, Zurich, Geneva, Ramsen and St. Gallen. In addition, it operates the Wannenboden logistics centre in Pratteln. Its services cover air freight, sea freight, road transport, customs services, project transport and logistics solutions. Particularly in air freight and international supply chains, the availability, integrity and confidentiality of IT systems are key success factors. Access to business-critical systems must therefore remain controlled, traceable and demonstrably secure at all times.
Starting Point & Motivation
Lamprecht wanted to strengthen IT security where the potential for damage is greatest: privileged accounts. Anyone with administrator rights can bypass security mechanisms, exfiltrate data or manipulate systems. Lamprecht therefore sought protection against insider attacks by its own employees or external providers with administrative access. At the same time, all user actions in privileged sessions had to be monitorable and traceable. The move to a tiered administration model provided the structural framework by strictly separating administrative accounts across system tiers. To guide these measures, Lamprecht chose the federal ICT minimum standard. Now maintained by the Federal Office for Cyber Security, this framework recommends measures to improve ICT resilience. Based on the NIST Cybersecurity Framework, it covers permissions and credentials, least privilege, and monitoring employees and external providers.
Simon Löschke
CISO
Challenge
Four key requirements shaped the project:
- Protecting privileged accounts against insider attacks: Administrator accounts used by internal staff and external providers carry the greatest potential for misuse. Moreover, static passwords known to several people would increase this risk further.
- Enforcing the tiered administration model: Administrators may use only the accounts designated for each tier. This rule therefore had to be enforced technically rather than left to everyday discipline.
- Monitoring user actions and integrating with the SOC: Activities in privileged sessions had to remain fully traceable. In addition, their metadata had to feed into the external SOC provider’s analysis.
- Providing evidence against the ICT minimum standard: Measures for permissions, credentials and monitoring needed a clear mapping to the recognised framework. Their implementation also had to remain verifiable at all times.
Organisational rules alone are difficult to enforce in practice. Meanwhile, conventional system logs show that an account has logged in. However, they reveal neither the person actually behind it nor what happened during the session.
Objectives
Solution
As part of the move to the tiered administration model, Lamprecht introduced Syteca with automatic password rotation. The platform now manages privileged credentials centrally in encrypted form and grants access according to roles within each tier. It also changes passwords automatically at regular intervals. Internal and external administrators access target systems through Syteca’s PAM functions. Meanwhile, Syteca records every privileged session and enriches it with contextual data. It then forwards the captured metadata to the SOC provider via Syslog. This creates a closed control loop of access control, monitoring and detection that implements key measures from the ICT minimum standard.
Why Syteca for the ICT minimum standard?
Integrating PAM seamlessly into the tiered administration model
Technical controls and evidence for the ICT minimum standard
The role of TECHWAY GmbH
TECHWAY GmbH supported Lamprecht from the requirements analysis based on the ICT minimum standard, through design, to Syteca’s production rollout. The analysis also included a comparison of several vendors. The central task was aligning the PAM architecture with the new tiered administration model. Together with information security and IT operations, TECHWAY defined roles and permissions for each tier and configured automatic password rotation. It then integrated internal administrators and external providers into the controlled access route. In addition, TECHWAY set up Syslog forwarding of Syteca metadata to the SOC provider. Privileged activities consequently feed seamlessly into the existing security monitoring. TECHWAY thus implemented the technical measures while embedding them in Lamprecht’s organisational security framework.
Conclusion
With Syteca, Lamprecht enforces its tiered administration model technically and effectively protects privileged accounts against misuse by insiders. Automatic password rotation, controlled administrator access and comprehensive monitoring of user actions implement key measures from the ICT minimum standard. Furthermore, the Syslog connection makes privileged activities part of the SOC provider’s continuous security monitoring. Lamprecht therefore has a robust foundation for transparency, control and verifiability in handling privileged access. This foundation can also evolve alongside future regulatory requirements.
FAQ
What is the ICT minimum standard, and what does it recommend for privileged access?
The ICT minimum standard is a federal recommendation for improving ICT resilience. National Economic Supply originally developed it, and the Federal Office for Cyber Security now maintains it. It is based on the NIST Cybersecurity Framework and primarily addresses operators of critical infrastructure. However, any company can use it as a reference framework. For privileged access, key measures cover permissions and credentials (PR.AC-1), least privilege and separation of duties (PR.AC-4). Audit and log records (PR.PT-1) and the monitoring of employees and external providers (DE.CM-3, DE.CM-6) are also relevant. Syteca implements these measures technically and makes their implementation verifiable, for instance to internal and external auditors.
What is a tiered administration model, and how does Syteca help enforce it?
A tiered administration model separates administrative accounts by system level. Typically, Tier 0 covers identity infrastructure, Tier 1 servers and applications, and Tier 2 client devices. Credentials from a higher tier are never used on systems of a lower tier. This prevents attackers from harvesting them there and misusing them to escalate their privileges. Syteca therefore grants each administrator access only to the accounts designated for their role and tier. It also makes every privileged session traceable.
How does automatic password rotation protect against insider attacks?
Static passwords for privileged accounts are often known to several people and can remain valid for long periods. They frequently persist even after role changes or the end of a service engagement. Syteca therefore changes these passwords automatically on a schedule or at the click of a button. Optionally, it also changes them each time a checked-out password is returned. Furthermore, if credentials are injected when the connection is established, administrators never need to know them at all. As a result, previously disclosed credentials become considerably harder to misuse.
How does the data captured by Syteca feed into the SOC?
Syteca forwards session metadata, alerts and audit log entries to SIEM and SOC platforms via Syslog in CEF or LEEF format. Optional TLS encryption also protects this transmission. The SOC provider can consequently correlate privileged activities with other event sources and assess anomalies faster. In addition, the included Session Player link allows analysts to review alerts directly in the context of the relevant session.
Is monitoring privileged sessions compatible with the revised Federal Act on Data Protection?
In principle, yes, provided the monitoring is designed appropriately. It serves information security and specifically targets privileged activities on critical systems, not employees’ general behaviour. The decisive factors are a clearly defined purpose, transparency towards those concerned, proportionate implementation and tightly restricted access to recordings. Syteca supports these safeguards through role-based permissions and the masking of sensitive data in recordings, among other functions.