CUSTOMER CASE STUDY SHUTTERFLY, INC.

Rapid Growth Spursthe Leader in Imaging
Products and Services toAdopt Sophos Cloud Optix
for Securing its Multi-Cloud
Environment.
Shutterfly, Inc. (NASDAQ: SFLY), is a leader in online personalized imaging
products and communications. Founded in 1999, the organization has
three diverse business units: Shutterfly Consumer, Lifetouch, and Shutterfly
Business Solutions.

CUSTOMER-AT-A-GLANCE
Shutterfly, Inc.
Industry
Online image-publishing
serviceWebsite
www.shutterfly.com

Sophos Solutions
Sophos Cloud Optix

CUSTOMER CASE STUDY SHUTTERFLY, INC.

‘One of the things that our operations and engineering
teams were excited about from day one was the ability ofSophos Cloud Optix to provide an accurate real-time asset
inventory, which is the foundation of any security program.’
Aaron Peck
VP and CISCO
Shutterfly, Inc.

Challenges
ÌÌ Improve real-time visibility into cloud

assets and security posture in anelastic multi-cloud environment

What impact does corporate
growth and expansion haveon cloud infrastructure?
Shutterfly is growing their customer base bothorganically and inorganically. In order to meetÌÌ Find a way to reduce manual complianceefforts, assessment, and monitoring,for SOC2 and other regulations inan ever-evolving environment
ÌÌ Secure infrastructure at thepace of DevOps by continuously
proactively analyzing and monitoring
infrastructure code changes

the needs of millions of consumers, Shutterfly
chose to embrace public cloud to benefit
from the agility and flexibility it brings.

What are the security
challenges that come about
with shifts in the business?
From an information security standpoint, this rapid
expansion was transformational. The Shutterfly
environment currently consists of several AWSand Azure accounts and numerous servers, withsteady amounts of traffic per day. The servercount at any given point is not stationary as theorganization dynamically spins up and spins down
servers to meet seasonal compute requirements.
So, the number one challenge was getting realtime visibility of the environment – servers,security groups, user access. The second biggest
challenge was to provide continuous complianceof the cloud environment. The last challenge wassecuring the environment at the DevOps pace wheredevelopers are constantly making changes.

What does a fast-growing
company look for in a multicloud security solution?
The solution should be cloud-agnostic and provide
consistent visibility, security, compliance, and policy
enforcement for all workloads across all the cloudCUSTOMER CASE STUDY SHUTTERFLY, INC.

‘Migrating to AWS and Azure made it necessary to transition
to an AI-powered multi-cloud security monitoring andcompliance platform. The correlated and contextual
alerts helped reduce the noise and allowed our teams
to focus on delivering value to the business.’
Aaron Peck
VP and CISCO
Shutterfly, Inc.

platforms in use. The solution also had to be extensible
and leverage artificial intelligence and machinelearning to make it possible for the teams to secure
Shutterfly’s dynamic, evolving cloud environment ina process efficient way. It needed to easily integratewith Shutterfly’s current security tools and beflexible enough to enable the team to onboard newtechnology platforms and changes as needed.

Peck, VP and CISCO for Shutterfly, Inc. “You can build

Sophos Cloud Optix drives the accuracy of its

a million controls, and you can deploy them, but if you

findings and its ability to correlate data.

don’t know which assets you’re protecting, you have noidea if those assets are actually covered by the controls
you’re deploying. The level of visibility made available
to us by Sophos Cloud Optix is critical for our work.”“With Sophos Cloud Optix, not only are the findings
as a whole more accurate, it is also capable ofproactively informing us about suspicious behaviors
it sees. And this is clearly not based on a predefined

Sophos Cloud Optix is also a huge time-saver. Whenset of rules, but something that improves overissues arise, the team can quickly search for a resource

time. Built-in artificial intelligence makes it possible

Why is visibility so criticalto pervasive and proactive
cloud security?

and receive a risk profile rich with valuable data, suchfor the solution to actually learn and adapt as it

as: Who owns it? What is it attached to? Where does

takes in more information,” observes Peck.

You cannot secure what you can’t see.

connections from the outside world? The automation“One of the things that my team was excited aboutfrom day one was the ability of Sophos Cloud Optix toprovide an accurate real-time asset inventory, which isthe foundation of any security program,” explains Aaron

it sit in the environment? What does it communicatewith? When was the last time modifications weremade to this resource? Is the resource accepting
provided by Sophos Cloud Optix replaces significant
manual effort, getting to issue identification andsolution paths faster, when every minute matters.
The artificial intelligence technology built into

Lastly, having a complete understanding of yournetwork topology and traffic is of the utmost
importance for securing your environment. Akey feature of Sophos Cloud Optix is real-timecomplete network topology and traffic visualization,
including ingress, egress, and internal traffic,
which enables the team to respond to andremediate security risks faster than ever before.

CUSTOMER CASE STUDY SHUTTERFLY, INC.

How does Sophos
Cloud Optix ease
compliance efforts?
Compliance needs to be continuous for cloud
workloads, and with out of the box templates
from Sophos Cloud Optix, the mundane work of
extracting the infrastructure status and mapping tothe compliance policies was significantly reduced.
The control ID feature, which maps commoncontrol of the overarching compliance tool withthe cloud infrastructure, is a great time savior.
“Our compliance team loves the ability to run reports
for compliance audits in seconds,” Peck states.

With the rapid pace of
new deployments andchanges, how do you deal
with configuration drift?
Shutterfly uses a software solution that allows DevOps
to release new software or make configuration
changes to cloud instances. In Shutterfly’senvironment, hundreds or thousands of changes
could potentially occur on a daily or weekly basis.
Sophos Cloud Optix continuously monitors anddetects drift in configuration standards and preventschanges to critical settings that could leave theorganization exposed to security vulnerabilities.
Team members can now sift through the changes
and determine which ones were outside the norm
and then take measures to remediate them.

‘Our complianceteam is now able
to run reports forcompliance audits
in seconds, which
was previously
manual andexceedingly timeconsuming.’
Aaron Peck
VP and CISCO
Shutterfly, Inc.

Try all Sophos Cloud Optix
features for free today.

Copyright 2019 Sophos Ltd. All rights reserved.
Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UKSophos is a registered trademark of Sophos Ltd. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.