How Darta transformed shared workstations into secure, user-friendly identification across its European sites
About Darta
Darta is an international producer of frozen products, including fruit, vegetables, herbs and ready meals. From its headquarters in Ardooie, the organization expanded its activities internationally, with sites in the United Kingdom, Portugal, Spain, Sicily and Italy, among others.
Around five years ago, Darta launched its badge authentication project. The reasons were straightforward. On one hand, Darta needed to meet the growing requirements of NIS2 and GDPR. On the other hand, the organization also wanted a stronger and more structured security strategy on the shop floor.
The Infrastructure Manager at that time, Ralph Houthoofdt, took the initiative to launch this so-called ‘Shared Service project’. The initial geographical scope was limited to the Ardooie site. But it soon became clear that the rollout to the other sites would be a crucial part of the project.
All systems, processes, and standards were designed to be easily scaled and reused. Once the configuration in Ardooie was complete, the setup could be replicated at the other sites with minimal adjustments.
The challenge: authentication didn’t really exist
Darta distinguishes between so-called “white and blue collars”. White-collar employees are primarily office workers, while blue-collar employees are active in Darta’s production environment. In the office environment, employees used domain-joined computers with classic on-premises Active Directory authentication. In the production environment, logging in didn’t really exist.
Most computers in the factory were continuously and automatically logged in through Citrix. Anyone who walked up to a workstation could start working immediately. That also meant every user shared the same rights and session. “The concept of logging in didn’t really exist,” says Ralph.
The result? Little to no traceability. There was no clear overview of who did what, and therefore no control.
There is no denying that this way of working is very convenient for employees. But it also introduces significant security risks. For example, if an unauthorized person gains access to the site, they can use a workstation without any authentication.
The organization needed a solution that could strengthen security on the production floor while keeping things workable and feasable for employees. That is why they started looking for a way to introduce badge authentication.
An all-in-one solution nobody planned for
ACEN came in contact with Darta as part of a Citrix project. The original plan was to add badge authentication on top of a Citrix environment, so employees could easily log in to their personal virtual desktop. But Imprivata was not specifically the goal there.
During the first workshops, a fundamental question quickly arose: Do we actually need the Citrix layer?
Almost all user accounts and workstations on the production floor had very similar profiles. The only major exceptions were the SCADA systems (Supervisory Control and Data Acquisition – for managing, controlling and monitoring processes and machines on the production floor) and ERP systems (Enterprise Resource Planning – insight into and connection of and between production processes).
ACEN proposed a fundamentally different approach: shared kiosk PCs with authentication through Imprivata.
"We were originally brought in for a badge authentication question on top of Citrix. But when we analyzed the environment, that Citrix layer turned out to add little to no value. By taking that step back, we were able to make the solution simpler, cheaper and more secure."
What’s more, Darta’s production environment consisted purely of fixed workstations, ‘fat clients’. This made the move from Citrix to a Windows-based environment relatively simple and cost-efficient. No hardware had to be replaced, and at the same time the costs and maintenance of the entire Citrix stack could be eliminated.
The savings generated by retiring the Citrix infrastructure effectively offset the investment in Imprivata.
For Darta, working with ACEN was an eye-opener.
"Where have you been all these years? We had so many different parties come in to tackle this challenge, but nobody came up with this solution.”
The implementation: technology wasn’t the biggest challenge
The successful proof of concept paved the way for a swift agreement and a fast-moving implementation. The project gained momentum. The first conversations took place in October 2022. The first production environment was already set up in January 2023.
Technically, the implementation went smoothly and quickly. Change management required more time and effort. More than 400 workers had to be issued badges. On- and offboarding procedures also had to be set up and refined. An additional difficulty was that Darta often works with temporary staff, such as seasonal workers and interim profiles. Dedicated processes and procedures had to be put in place for them as well.
Employees were used to walking up to a workstation and getting started immediately. Now, they first had to badge in and log in. That extra step was met with some skepticism, especially at first. Thanks to Imprivata, however, the impact on day-to-day operations remained minimal. Presenting a badge and entering a personal PIN is enough. Employees then automatically get access to all the applications they need with Single Sign-On.
One badge, a wide range of use cases
MIFARE DESFire EV3 badges were a deliberate choice, as they offer enough capabilities to support future applications as well.
What started as an authentication badge for the computers on the factory floor is increasingly evolving into a multifunctional means of identification. In recent years, for example, the solution was extended to mobile applications. Today, the handheld scanners and forklifts in the factory are also equipped with Imprivata.
Forklift drivers use the same badge to activate their vehicle and to log in to the tablet in their vehicle. Handheld scanner users also get immediate access to SAP under their personal account thanks to badge authentication.
“An important advantage of Imprivata for Darta is the flexibility within SAP,” says Ralph. “With Imprivata, you can distinguish between the user logged in to Windows and the user linked to the scanned badge.” A packer can, for example, work from a generic Windows profile, while a lab technician temporarily authenticates with their badge to carry out quality checks. Imprivata then automatically ensures that the right identity and user rights are applied. That flexibility was a huge selling point for Darta.
"Workers don’t need to enter or even know their own password anymore. Everything is generated and managed automatically. Badging makes the whole process easier, faster and more secure.”
And the evolution doesn’t stop there. Where employees still use two badges today, one for physical access to the site and one for authentication on the computers, these will be combined into a single badge next year.
At the same time, the chosen DESFire EV3 badges offer a high level of security and are very difficult to copy.
Ardooie as the foundation for an international standard
After the success in Ardooie, Darta quickly decided to roll out the platform to the other sites as well. Thanks to the standardized architecture, the internal IT team was able to replicate the solution relatively easily. Expanding to other sites comes down to ordering extra badges, installing badge readers and adopting the existing processes locally.
First up was the site in Yorkshire. Portugal followed later. After expanding the solution to mobile devices last year, Spain and Italy are now also on the roadmap.
"The system is essentially language-independent. The only word that matters is the label ‘user’. Beyond that, badge authentication works the same everywhere.”
Thanks to this stability and standardization, Darta can also carry out most rollout projects with its own IT team. ACEN is mainly involved for specific questions or new use cases.
Ralph adds that the Citrix layer still brought an element of uncertainty. With Imprivata, every change is still thoroughly tested before it goes into production. However, it’s much easier to predict how the solution will perform in a new setup.
The results
There are no hard figures, but the impact at Darta is significant.
1. Less complexity
With the Citrix environment gone, the infrastructure became considerably less complicated. According to Darta, the number of infrastructure tickets halved after the migration. As a result, the workload for the internal IT team was reduced, freeing up time for other projects.
2. Time savings
Removing the Citrix layer saved costs and maintenance. On top of that, badge authentication saves employees time by removing the need for manual password logins. As a result, production processes run more efficiently.
3. Insight and traceability
NIS2 readiness was an important driver in this project. Where there used to be little to no insight into who did what, Darta now has a detailed overview of user activity.
Thanks to individual user identification, extensive logging and audit information, Darta now has full traceability of user activity. This not only strengthens security, but also supports compliance with the stricter NIS2 requirements across Europe.
4. An exceptionally stable platform
According to Ralph, one of the most striking results is the stability of the environment: “I can say it without hesitation: Imprivata is probably the most stable system we have running today.”
Even the migration from VMware to Hyper-V went smoothly. And thanks to built-in redundancy, upgrades have hardly any impact on operations.
About the collaboration and future plans
Over the years, Darta and ACEN worked closely together to maximize the value of the solution. New ideas were continuously explored and tested, with both parties maintaining a critical perspective.
ACEN’s role was not limited to implementing new technologies. Existing processes and architectures were also put under the microscope. This aligns with ACEN’s broader vision: when something does not seem logical or optimal, or when there is room for improvement, we challenge assumptions and advise on the best possible approach.
Beyond support, Ralph also stresses the value of continuity in the collaboration with the ACEN IGA team. Over the years, Richard and his colleagues have been a trusted point of contact for Darta. “Working with the same person throughout the project is an advantage not to be underestimated,” he notes. “Knowledge transfer inevitably comes with some loss of information. You always lose something along the way, even if it’s just the personal touch.”
Because Imprivata has become such an important system for Darta, the options for a managed service and/or support model are now being explored.
For Darta, the architecture has become indispensable today. And Ralph has no hesitation in recommending it to other industrial organizations:
"This type of problem exists in almost every factory. To be honest, I don’t know how many other organizations solve it today. During the proof of concept I kept thinking: why didn’t I know this existed?"
