The Challenge

Sitting between retailers and delivery partners, Scurri plays a vital role in the burgeoning global ecommerce sector. Its delivery platform is integral to the success of its growing customer base, so ensuring it is secure, resilient and compliant with international standards is absolutely critical.

The business takes protecting customer information extremely seriously and regularly carried out manual audits to evaluate its internal security posture. As a manual process, it would take up valuable time and resources, yet was vital to protect sensitive data and give customers peace of mind. Scurri is also working towards full ISO/IEC 27001, the International information security standard, and the manual process provided only limited information suitable for accreditation purposes. It needed a solution that would be more efficient, eliminate manual processes, provide host visibility and deliver an information rich ISO27001-compliant security posture.

Critical success factors

• Eliminate time and resource-consuming manual processes
• Illustrate a robust, resilient security posture
• Provide reliable information for ISO27001 accreditation

The Solution

“We looked at multiple cloud-security solution providers to evaluate what was on offer and whether it would be a suitable fit for our business model,” said Junior Godoi, Software Engineering Manager at Scurri. “After a number of demos, it became clear that many potential solutions lacked critical tools and would fail to deliver the benefits we sought. Lacework’s data-driven security platform for cloud stood out. It would deliver a compliant, secure platform and provide high visibility of information to help us improve customer service and ultimately achieve ISO27001 compliance.”

Lacework’s security monitoring and threat detection solution delivers a robust solution that would assist with compliance, minimise manual work and deliver enhanced platform visibility. Lacework recommended Softcat as a partner, which has a dedicated team of AWS specialists with the skills to design and deploy secure, compliant applications and is one of the UK’s leading accredited AWS Partner Network (APN) providers.

Paul Good, Cyber Security engineer at Scurri, takes up the story. “The ‘proof of value’ illustrated during the demo we took part in ensured we had a strong business case to help secure the investment from the business and justify the expenditure. From day one, the collaboration while onboarding the solution between Softcat and Lacework was superb. A slack channel was established with content that provided real insight into how best to leverage both the AWS and security solutions for our specific business needs. Whenever we reached out, we got a speedy response that was invariably positive and helpful.”

“We installed the solution on trial machines to properly evaluate its capabilities and, with the help of Lacework’s specialist support, were up and running within half an hour,” said Junior. “We received great advice and guidance and had total confidence that the solution would be implemented correctly. If we’d have implemented it using our in-house resources we may have encountered issues. The support we had on tap from both providers gave us real confidence. Once the download agent was installed and correctly configured, within a few minutes we could see the solution doing its magic in the background. In many ways, it was mind-blowing that something so simple to install could be so effective.”

Solution highlights

• Informative demonstration sessions to help evaluate solution capabilities
• Close collaboration with Softcat AWS team and Lacework specialists
• Robust solution evaluation strengthened business and investment case
• Hands-on support throughout implementation and configuration

The Benefits

With Softcat’s help, migrating to AWS, the world’s most widely adopted and comprehensive cloud service, Scurri’s offering has strengthened. The platform provides a robust, resilient, and above all, secure vehicle for growing its customer base. Softcat’s AWS solution also includes a number of added value elements to simplify and accelerate the procurement cycle. Scurri now has access, through an easy-to-set-up subscription model, to an extensive online software catalogue via AWS Marketplace. It enables Scurri to rapidly process AWS invoicing, maintain full control over the procurement sales cycle and achieve extra value by purchasing business-critical software through a private Softcat offering.

“We’re still expanding as a business and have a relatively small IT team,” said Junior. “Working with Softcat enabled us to simply and quickly transform our hosting and provide a world-leading platform that customers can rely on and have confidence in. When coupled with the automated, data-driven features of the Lacework platform, Scurri has eliminated hours of potential work and is freeing up the IT team to concentrate on service enhancements and achieving ISO compliance.”

Paul agrees. “Lacework provides the visibility and control we need without requiring intervention from the IT team. Using our old methodology meant creating and updating tools to harness the essential data we need for compliance, whereas Lacework now does it all. We’ve had excellent support from Lacework. It can be hard to properly evaluate the value of the tools available within the solution, but the support we’ve received has eliminated that difficulty and enabled us to clearly see the benefits.

“It has also improved collaboration between teams within the organisation. The alerts generated by Lacework can be configured to be automatically shared with individual teams through multiple channels. It delivers powerful and actionable data that can be used by DevOps and SecOps teams to run vulnerability scans during the development cycle, helping to identify and ameliorate risk before we get to market. It’s enabled us to focus resources on service improvements and enhanced our security posture significantly.”

“For smaller organisations like ours, being able to rapidly implement a comprehensive solution requiring minimal staff input to set up and run is immensely valuable,” said Junior. “It represents terrific value for money and brings us another step closer to achieving compliance and securing ISO 27001 accreditation. The solution also enables customers to assess their own security posture. The outputs it delivers provide a clear illustration that we take security seriously and are compliant with international standards even as we are working towards full accreditation.”

Paul continues, “Being able to prove our systems are compliant with internationally defined standards is an essential element of the ISO accreditation journey. GDPR, for instance, specifies a number of targets that must be reached. Lacework is providing the data and intelligence to meet those obligations, prioritise what needs to be done and clearly illustrate compliance.”

“While it’s difficult to precisely quantify the amount of time the IT team is saving,” said Junior, “the solution is definitely speeding up our reaction time and enabling an immediate response to any security alerts it produces. Without it, Paul could fill his days aggregating information to illustrate compliance. Now, if a client asks a question, he can quickly and simply provide rock-solid evidence of our security posture and reassure the client without being distracted from his core task of focusing on delivering optimal customer service.”

Benefits at a glance

• Trusted, world-leading hosting platform
• Time-saving automated system minimising manual intervention
• Enhanced collaboration between internal teams
• Precious IT resources freed to concentrate on enhancing customer service

Why Softcat?

“Softcat made what could have been a complex engagement simple and straightforward,” said Junior. “The great price it managed to secure, knowledge of AWS and standing within the AWS Partner Network meant we knew we’d chosen the ideal provider. It gave robust answers to all of our questions around billing, implementation, and how the solution could enhance procurement processes. This enabled us to highlight where Softcat could add value and helped strengthen the business case with our finance team.

“Working with Softcat and Lacework has been like working with colleagues rather than third-party providers. The whole engagement has been characterised by close, collaborative working between all three parties. It’s helped to engender a real sense of trust and contributed to the significant value add we witnessed during the implementation and expect to leverage throughout the lifespan of the three-year agreement and beyond.”