SGS: creating a more secure, agile and sustainable infrastructure in the cloud

“If you ask anyone at SGS what’s in the DNA of the company, they will all say the same two words: integrity and safety. We want to add a third word to the list: security.”

Frederic Ducret, Global Head of Cloud and IT Infrastructure at SGS is talking about the core qualities that define the world’s largest and most successful auditing, testing, inspection and certification company.

“Since I joined SGS a quarter of a century ago, we have always talked about the critical importance of integrity, because our business relies on the trust that our customers have for SGS,” Ducret continues. “We have zero-tolerance against any deviation from our integrity policy within our network, as it could ruin our reputation if someone does something bad somewhere.

“In the digital age, you need to secure your infrastructure, data and applications to enforce integrity. That’s a big piece of our move to the cloud.”

It is a move that has been ongoing since Ducret’s team presented the case to move the company’s infrastructure from on-premise data centers housed primarily in SGS offices across the globe, to the Azure cloud.

With over 80% of the company’s servers now based in the cloud, the team are well on their way to achieving their ultimate goal of being a cloud-only company. And they are reaping the security benefits that cloud-based solutions like Azure Sentinel are bringing the company.

Unifying the company’s infrastructure in the cloud

Established in Switzerland in 1878, SGS has grown over nearly a century and a half into the industry leader in inspection, verification, testing and certification. With more than 89,000 employees operating from some 2,600 offices and laboratories around the world, SGS has established itself as the global benchmark for quality and integrity.

“We provide analysis of products and substances for our customers,” explains Ducret. “So we could go to a tanker, for example, take a sample of the oil, analyze it and then provide an objective analysis of whether it is compliant with our customers’ requirements.”

Making sure that SGS’s operations are robust is a key priority for Ducret. “We need to make sure our services and applications are always-on,” he says. “Our reputation depends on it, so that is my number 1 priority.”

But in the last couple of years, there has also been an increased focus on introducing some agility to the operations at SGS. “We want to be able to deliver new services to the business, things like IoT and other digital innovations,” he says. “And the cloud strategy we have in place is the foundation of that.”

Another key driver of the company’s cloud strategy is the unification of SGS’s vast infrastructure. “We came from a situation where we had applications distributed in 180 local data centers. And these weren’t state of the art data centers. In some cases, it was just a computer room with a couple of servers and some basic facility services.”

So in 2017, the company took the decision to move to Azure. And it has ushered in a new era for the company. One that is more agile, optimized and secure.

Gaining company-wide security visibility with Azure Sentinel

“When we presented our case for moving to Azure to the top management, security was the big area we focused on,” recalls Ducret, who oversaw cyber security for SGS until the end of 2020. “We showed them that the setup we had with our applications running in 180 different data centers across the world was far from optimized from both a security and a cost perspective.”

“If we wanted to improve the security, it would cost a fortune because in each location we had different technologies. For example, if you wanted to implement web application firewalls across the network, you would have to buy, implement and maintain a specific solution at each location.”

But the security case for the cloud was about more than the bottom line. It was also about increasing visibility across the network. “We have something like 75,000 computers and 85,000 users distributed across more than 140 countries worldwide,” says Ducret. “Of course, from a network perspective, that presents a challenge.

“Before the cloud, at group level, we had limited visibility over the compliance of our local affiliates across the world to the high standards SGS needs to respect. Now with Azure, we have this global visibility and we are able to automate some processes to help our Security Operations Center prevent and detect any anomalies they may have.”

The company has been using various cloud-based security tools, including Azure Sentinel – a cloud-native security information and event management (SIEM) platform that uses built-in AI to help analyze and correlate large volumes of data across enterprises.

The solution allows SGS to define different use cases to detect security threats across its network. “We have defined 12 use cases,” says Ducret. “It allows us to correlate different events and convert them into a security incident, if it is indeed a security incident. We have 75,000 computers and 4,000 servers, so we have many security events every day. It’s not manageable if you don’t have something which automatically analyzes those events and identifies which ones require an action.

“You also get some forensic capabilities with Azure Sentinel,” he adds. “The logs of these incidents are centralized and Sentinel gives us the tools to make some queries and do some forensic analysis of cybersecurity threats.

“And of course, the ease of integration with Azure and the broader Microsoft ecosystem is game changing, especially when it comes to quickly deploying and leveraging a solution in a Microsoft environment.”

Boosting the company’s security posture

One of the most important aspects of having Azure Sentinel is that SGS can reassure their customers that they have comprehensive cybersecurity solutions and practices in place. “Nowadays, customers will ask if we are using an SIEM,” says Ducret. “And it’s important for our security posture score that we can say yes.”

Companies like BitSight and Scorecard can scan the external exposure of companies like SGS and publish reports detailing the effectiveness of the solutions they are using.

“Increasingly, customers looking for testing and certification services like ours will check the external security posture scores of the companies that they are going to work with,” says Ducret. “So for us It’s very important to have a good ranking.”

With Azure Sentinel, the company is increasing that external security posture. But SGS are also working to create their own security ranking internally too.

“We’ve started to create an internal security index to compare affiliates within our network and put them in friendly competition with each other,” says Ducret. “One part of this security index is the completion rate of the security awareness program which we have developed. Each SGS employee has to undertake three per year, and we report the compliance by the completion rate based on location.

“And it is all possible because of how easy the cloud makes it to track this sort of information across our network,” he adds.

Increasing the company’s sustainability credentials

Aside from the security, agility, optimization and cost-saving benefits of the company’s move to the cloud, there are also more profound impacts linked to sustainability.

“A cloud supplier like Microsoft will be much better at optimizing the datacenter’s energy consumption, or consuming blue or green energy, than SGS,” says Ducret. “We cannot achieve the same level of optimization with our internal datacenters – that’s not part of our core business to do that.

“So from this sustainability point of view, there are also considerable benefits of the cloud,” he continues. “And this is important because more and more companies are reporting to an external sustainability index. SGS is very proud to be one of the top companies in the sustainability index. And that’s partially due to the fact that we have been adopters of cloud technology like Microsoft 365 and Azure.

“Now we want to move all our applications to the cloud and embrace not just a cloud-first approach, but become a cloud-only company.”

A big part of that next step will be to introduce Microsoft Teams telephony to the company. “We are already using Teams telephony in our Geneva office and we want to develop a global strategy so that our affiliates can adopt this technology too,” says Ducret.

“So going forward, I think we have a great cloud foundation. It puts us in a strong position to introduce new innovations and strengthen the business with capabilities like IoT technology. It will help us become much more data-driven,” he concludes.

“We have a great footprint for us to take the next step.”