Man walking in front of wind turbines

SGS: creating a more secure, agile and sustainable infrastructure in the cloud

Inés Rivas Carnero

Inés Rivas Carnero

Azure Integrated Marketing Manager | Western Europe

Read Time, 7 min.

“If you ask anyone at SGS what’s in the DNA of the company, they will all say the same two words: integrity and safety. We want to add a third word to the list: security.”

Frederic Ducret, Global Head of Cloud and IT Infrastructure at SGS is talking about the core qualities that define the world’s largest and most successful auditing, testing, inspection and certification company.

“Since I joined SGS a quarter of a century ago, we have always talked about the critical importance of integrity, because our business relies on the trust that our customers have for SGS,” Ducret continues. “We have zero-tolerance against any deviation from our integrity policy within our network, as it could ruin our reputation if someone does something bad somewhere.

“In the digital age, you need to secure your infrastructure, data and applications to enforce integrity. That’s a big piece of our move to the cloud.”

It is a move that has been ongoing since Ducret’s team presented the case to move the company’s infrastructure from on-premise data centers housed primarily in SGS offices across the globe, to the Azure cloud.

With over 80% of the company’s servers now based in the cloud, the team are well on their way to achieving their ultimate goal of being a cloud-only company. And they are reaping the security benefits that cloud-based solutions like Azure Sentinel are bringing the company.

Unifying the company’s infrastructure in the cloud

Established in Switzerland in 1878, SGS has grown over nearly a century and a half into the industry leader in inspection, verification, testing and certification. With more than 89,000 employees operating from some 2,600 offices and laboratories around the world, SGS has established itself as the global benchmark for quality and integrity.

“We provide analysis of products and substances for our customers,” explains Ducret. “So we could go to a tanker, for example, take a sample of the oil, analyze it and then provide an objective analysis of whether it is compliant with our customers’ requirements.”

Making sure that SGS’s operations are robust is a key priority for Ducret. “We need to make sure our services and applications are always-on,” he says. “Our reputation depends on it, so that is my number 1 priority.”

But in the last couple of years, there has also been an increased focus on introducing some agility to the operations at SGS. “We want to be able to deliver new services to the business, things like IoT and other digital innovations,” he says. “And the cloud strategy we have in place is the foundation of that.”

Another key driver of the company’s cloud strategy is the unification of SGS’s vast infrastructure. “We came from a situation where we had applications distributed in 180 local data centers. And these weren’t state of the art data centers. In some cases, it was just a computer room with a couple of servers and some basic facility services.”

So in 2017, the company took the decision to move to Azure. And it has ushered in a new era for the company. One that is more agile, optimized and secure.

Gaining company-wide security visibility with Azure Sentinel

“When we presented our case for moving to Azure to the top management, security was the big area we focused on,” recalls Ducret, who oversaw cyber security for SGS until the end of 2020. “We showed them that the setup we had with our applications running in 180 different data centers across the world was far from optimized from both a security and a cost perspective.”

“If we wanted to improve the security, it would cost a fortune because in each location we had different technologies. For example, if you wanted to implement web application firewalls across the network, you would have to buy, implement and maintain a specific solution at each location.”

But the security case for the cloud was about more than the bottom line. It was also about increasing visibility across the network. “We have something like 75,000 computers and 85,000 users distributed across more than 140 countries worldwide,” says Ducret. “Of course, from a network perspective, that presents a challenge.

“Before the cloud, at group level, we had limited visibility over the compliance of our local affiliates across the world to the high standards SGS needs to respect. Now with Azure, we have this global visibility and we are able to automate some processes to help our Security Operations Center prevent and detect any anomalies they may have.”

The company has been using various cloud-based security tools, including Azure Sentinel – a cloud-native security information and event management (SIEM) platform that uses built-in AI to help analyze and correlate large volumes of data across enterprises.

The solution allows SGS to define different use cases to detect security threats across its network. “We have defined 12 use cases,” says Ducret. “It allows us to correlate different events and convert them into a security incident, if it is indeed a security incident. We have 75,000 computers and 4,000 servers, so we have many security events every day. It’s not manageable if you don’t have something which automatically analyzes those events and identifies which ones require an action.

“You also get some forensic capabilities with Azure Sentinel,” he adds. “The logs of these incidents are centralized and Sentinel gives us the tools to make some queries and do some forensic analysis of cybersecurity threats.

“And of course, the ease of integration with Azure and the broader Microsoft ecosystem is game changing, especially when it comes to quickly deploying and leveraging a solution in a Microsoft environment.”

Boosting the company’s security posture

One of the most important aspects of having Azure Sentinel is that SGS can reassure their customers that they have comprehensive cybersecurity solutions and practices in place. “Nowadays, customers will ask if we are using an SIEM,” says Ducret. “And it’s important for our security posture score that we can say yes.”

Companies like BitSight and Scorecard can scan the external exposure of companies like SGS and publish reports detailing the effectiveness of the solutions they are using.

“Increasingly, customers looking for testing and certification services like ours will check the external security posture scores of the companies that they are going to work with,” says Ducret. “So for us It’s very important to have a good ranking.”

With Azure Sentinel, the company is increasing that external security posture. But SGS are also working to create their own security ranking internally too.

“We’ve started to create an internal security index to compare affiliates within our network and put them in friendly competition with each other,” says Ducret. “One part of this security index is the completion rate of the security awareness program which we have developed. Each SGS employee has to undertake three per year, and we report the compliance by the completion rate based on location.

“And it is all possible because of how easy the cloud makes it to track this sort of information across our network,” he adds.

Increasing the company’s sustainability credentials

Aside from the security, agility, optimization and cost-saving benefits of the company’s move to the cloud, there are also more profound impacts linked to sustainability.

“A cloud supplier like Microsoft will be much better at optimizing the datacenter’s energy consumption, or consuming blue or green energy, than SGS,” says Ducret. “We cannot achieve the same level of optimization with our internal datacenters – that’s not part of our core business to do that.

“So from this sustainability point of view, there are also considerable benefits of the cloud,” he continues. “And this is important because more and more companies are reporting to an external sustainability index. SGS is very proud to be one of the top companies in the sustainability index. And that’s partially due to the fact that we have been adopters of cloud technology like Microsoft 365 and Azure.

“Now we want to move all our applications to the cloud and embrace not just a cloud-first approach, but become a cloud-only company.”

A big part of that next step will be to introduce Microsoft Teams telephony to the company. “We are already using Teams telephony in our Geneva office and we want to develop a global strategy so that our affiliates can adopt this technology too,” says Ducret.

“So going forward, I think we have a great cloud foundation. It puts us in a strong position to introduce new innovations and strengthen the business with capabilities like IoT technology. It will help us become much more data-driven,” he concludes.

“We have a great footprint for us to take the next step.”

Free eBook: Five questions executives should be asking their security teams

See what questions you need to ask about your organisation’s security measures

Protect your business with Microsoft security and Surface

Discover How IT and business leaders facilitate safety, trust, and collaboration in our modern workforce

Discover more related articles per industry:

Education

Government

  • Iceland runs on Trust

    How the cloud helped a small nation realise big ambitions

    In December 2015, the Icelandic government kicked off a digital infrastructure review. With more than 100 different suppliers managed by over 100 IT managers in each public institution, the brief was clear; to simplify operations and streamline IT for over 20,000 users. The solution: Fast forward two and a half years, and a decision was […]

  • How VR Group is using automation to secure Finland’s railways

    How VR Group is using automation to secure Finland’s railways

    “Being at the helm of a critical piece of infrastructure, we have a huge responsibility towards our partners and clients. That’s why safety and security are crucial elements of what we do and how we operate.” Mikke Maronen, CISO at Finnish railway company VR Group, is talking about the importance of protecting his business from […]

Healthcare

  • a woman standing in front of a screen

    Istituto Neurologico Carlo Besta: providing essential patient care from a distance

    “Telehealth was a technology we’d been planning to implement for a couple of years. But then almost overnight everything changed – it became a must-have platform the hospital needed today.” Francesca De Giorgi, CIO of Italian research hospital IRCCS Carlo Besta, reflects on the recent challenges her team faced when social distancing measures imposed by […]

  • Two female nurses having a virtual conversation through Microsoft Teams

    Belfast Trust: Reimagining patient care

    “There have been many heroic actions by our staff but we’re not heroes for what we’ve done – I’m just glad we could do our bit to help.” Paul Duffy, Co-Director of IT and Telecommunications at Belfast Trust, is talking about the monumental impact COVID-19 has had on the healthcare sector and how virtual consultations […]

Manufacturing

Retail

Discover more related articles per dossier:

Customer Stories

  • Nurse and patient

    MOB: increasing healthcare workers’ time with their patients using cloud technology

    “Time is the most valuable currency in healthcare. That’s what this technology gives us: more time with our patients.” Fettah Erdal, Senior Administrator at Dutch healthcare provider MOB is talking about the impact that cloud-based technology is having on his organization’s ability to deliver more patient-centred healthcare. “All of our care workers are in the […]

Digital Transformation

  • Picture from the back of a person attending a Teams meeting with 2 colleagues, discussing about a furniture fabric.

    Zuiver: Supporting both business and culture through technology

    “Since moving to the cloud, there are no limitations anymore. And I’m certain without this technology, we would not have seen the growth we have today.” Jaap Landsaat, CFO and Head of IT at Dutch furniture designer Zuiver, is talking about the profound impact technology has had on the business he co-founded more than 20 years ago. “Back then, we had 100 orders a week […]

Security & Privacy

Tips

  • a person sitting at a table using a laptop

    How to run the most successful and secure meetings with Microsoft Teams

    With so many people now working from home, it’s more important than ever to hone our remote working skills and stay productive. We have seen a huge spike in the number of people successfully and securely working together via Microsoft Teams. But whether you are brand new to the tool, or already conduct your meetings on Teams, […]