Freudenstadt Hospital: Optimizing Network Management, Security, and Costs with DDI and DNS Security

The Freudenstadt District Hospitals (KLF) is a primary and standard care facility, including a geriatric rehabilitation unit, with 380 beds, spread across two locations in Freudenstadt and Horb. The hospital employs 1,050 people and treats approximately 17,000 inpatients and 37,500 outpatients annually. In addition, 800 patients are cared for at the Horb Geriatric Rehabilitation Clinic.

Project Objectives

• Optimize and accelerate network infrastructure management
• Remove costly dependence on Microsoft DNS and DHCP services
• Integrate DDI into the existing network environment and provide an automation platform
• Improve protection against cyberattacks and data theft

Main Benefits

• 80% time savings through simplified and automated IP address management
• Reduced complexity
• Risk minimization and improved security
• Highly available provision of network services in DDI
• Improved operational efficiency through DDI integration of Extreme Networks and Fortinet solutions

“We chose EfficientIP DDI because it integrates perfectly into our existing environment with solutions from Extreme Networks and Fortinet. It met many of our network management and automation requirements”
Ralf Kaufmann, IT Manager, Freudenstadt Hospital

Situation and Challenges Being Faced

KLF faced significant challenges with the running of their network infrastructure, in terms of operational efficiency and cost. IP addresses were being documented in an Excel file, with a static IP address allocation system used. The result was significant time of the IT team being wasted for managing the IP addresses. Naming was a complex task, and manual administration led to configuration errors such as duplication of IP addresses being assigned, resulting in operational disruptions. In addition, networks were sometimes configured but forgotten to be documented. All this meant the Hospital’s IT team were having to cope with an unreliable data repository and a lack of visibility on devices across their network. With cyberthreats rising, this poor visibility was an important concern, particularly bearing in mind the rapidly growing digitalization of the hospital environment requiring more and more systems to be monitored and protected.

For their DNS and DHCP services, the Freudenstadt Hospital was using Microsoft servers, The licensing costs for these were starting to cause concern, as KLF were obliged to purchase client access licenses even for devices such as their printers.

Given all these growing demands, it was evident to IT Manager Ralf Kaufmann that manual management of IP addresses was no longer feasible and should be automated as much as possible. Additionally, security needed to be enhanced and their automation strategy extended to incorporate their NAC and Firewalls.

The Selected EfficientIP Solution

To address its network management, automation, and IT security challenges, KLF chose EfficientIP’s comprehensive solution portfolio. SOLIDserver™ DDI appliances integrate DNS, DHCP, and IP address management (IPAM) into a single, unified platform and are seamlessly integrated into the Microsoft domain. All information is aggregated in the IPAM database to establish a precise network source of truth (NSoT). This comprehensive data is used by KLF to power ecosystem components in the network and for IT security.

Ralf Kaufmann explained: «We chose EfficientIP DDI because it integrates perfectly into our existing environment with solutions from Extreme Networks and Fortinet. It met many of our network management and automation requirements.»

The EfficientIP solution was recommended to KLF by its service provider, BELL Computer-Netzwerke GmbH, as part of the expansion of its IT security concept and was integrated into the existing environment. DNS Guardian from EfficientIP was selected by KLF’s IT department to strengthen network security, particularly to protect against DNS tunneling, which could be used by cybercriminals to steal data and is undetected by conventional security components.

“With the upcoming launch of EfficientIP’s DNS Guardian, we are now much more confident in our ability to protect critical healthcare data from data theft and ransomware.”
Ralf Kaufmann, IT Manager, Freudenstadt Hospital

Main Results

By automating and centralizing the administration of DNS and DHCP services, EfficientIP’s DDI solution has not only reduced manual workload but also provided KLF with comprehensive visibility and control over its IT infrastructure. Duplicated IP addresses and configuration errors are now a thing of the past, and granular delegation of rights per user based on least privilege is possible. According to Ralf Kaufmann, «SOLIDserver™ DDI’s automation capabilities have significantly increased productivity and led to time savings of up to 80% in network administration.» Independence from Microsoft product licensing has resulted in significant cost savings.

Regarding security, Kaufmann explains: «With the upcoming launch of EfficientIP’s DNS Guardian, we are now much more confident in our ability to protect critical healthcare data from data theft and ransomware.» The solution automatically protects access to patient data by analyzing DNS traffic to detect DNS tunneling or C2C, thus taking action in real time against DNS-based data leakage attempts. This significantly contributes to compliance with regulatory requirements such as GDPR, KRITIS, and NIS2.

By leveraging EfficientIP DDI’s open APIs, service provider BELL Computer-Netzwerke GmbH was able to integrate many valuable automations that have improved KLF’s operational efficiency and network security. One example is the data exchange between DDI/IPAM and Extreme Networks’ network management system, which enables the automatic creation of network objects and reports the status of an endpoint device from network access control to IPAM.

Another integration exists with ecosystem partner Fortinet, where, for example, data from IPAM is sent to Fortinet systems to ensure consistent security policies. Furthermore, the isolation of affected devices can be automated whenever a threat is detected.

In the Future

EfficientIP’s DDI and DNS security solutions provide KLF with a solid, scalable, and future-proof platform to effectively manage its complex network and ensure robust security. With upcoming IT initiatives in mind, KLF will focus on digital transformation, clinical processes, and cybersecurity. As part of its efforts to strengthen network security, KLF plans to integrate additional DDI and DNS Guardian features.

To manage rapid growth in a constantly evolving technology landscape, KLF’s strategic IT approach underscores its commitment to maintaining a secure, resilient, and efficient network and IT security infrastructure. This includes compliance with regulations such as KRITIS and NIS2, as well as the further development of automation processes.