FunkyPigeon.com is one of the biggest online personalised gift and greetings card retailers in the UK. With three million active customers, buying products weekly or monthly and that figure growing 30% year-on-year, it needed to find a solution to keep its systems secure as they scale.
Seasonal scalability is essential
As is the case across retail, FunkyPigeon.com's business is extremely seasonal, with traffic peaks on occasions such as Mother's Day, Father's Day, Valentine's Day, Christmas and Easter. For example, the site's traffic quadrupled over the Mother's Day period in 2016 and it's expecting similar traffic peaks in 2017.
This requires a very flexible infrastructure that can scale up for the six-to-10 weeks a year it experiences the bulk of its customers coming to the site, but then scale back down when personalised gifts aren't as popular to ensure it can keep costs controlled.
With PCI DSS regulations also to think about, FunkyPigeon.com needed to prove to internal auditors its customer data was secure too.
"We needed to promote a general awareness within our industry that it wasn't if, but when we needed it, to make sure we can protect against casual attackers as well as professional [ones]," Brett King, head of service delivery at FunkyPigeon.com, said.
"We also needed to give that reassurance to the CEO and the board that we were secure and although these attacks were happening, they weren't getting anywhere and if they did, we could deal with it."
Deciding which way to go
King explained FunkyPigeon.com had two choices to ensure it was protected against vulnerabilities. The first was to manage its security itself, so it began considering how it would do this, what systems it would need, the server power, the people available to manage it and how to deal with keeping on top of security 24/7.
The other option was to outsource everything to a Security-as-a-Service provider.
"We had to think about how to deal with monitoring and see what was going on and making sure it was doing job and giving the service levels we needed," King said.
AlertLogic offered everything the company needed with its Cloud Defender service, which monitors FunkyPigeon.com's entire AWS-based cloud infrastructure.
Getting security online, fast
The initial deployment of the Alert Logic solution took around an hour to get to a point where it had data reporting back that could be analysed. It then took another 8-12 hours for the full deployment to be completed within FunkyPigeon.com's cloud environment.
"This was definitely faster than we anticipated as we had allowed two days for the initial deployment, and a week for the rest," King commented. "Deployment to our on-premise infrastructure was slightly longer, but again, was completed much faster than expected."
Following the initial deployment to the company's AWS cloud environment, FunkyPigeon.com ran the solution for two weeks to confirm that data was being delivered to Alert Logic correctly and that all the alerts were set-up to provide the appropriate information if it detected unusual activity.
When the company was happy that the data coming back was accurate from the cloud deployment, the IT team only tested the on-premise solution for around two days to make sure data transfers were working as anticipated.
Bringing together expectations and reality
"A key requirement of the system was to allow all our external support partners to be able to access our security monitoring, and this has been achieved with the Alert Logic solution," King said. "It's also allowing them to identify further improvements in our systems. By monitoring the type of 'attacks' we are seeing, we've been able to further tighten our code base to harden our systems."
He added that the IT team can now easily report back to the infosec board in great detail about the number, type and severity of attacks on its systems on a monthly basis, while also giving the company the insight it needs to feed into the group security strategy and ensure compliance.
AlertLogic's Cloud Defender enables FunkyPigeon.com to tick the box for security, King explained. With all of the logs in one place for both the AWS and the production environment, the company can ensure both aspects of its business are protected.
It's a true end-to-end system, rather than the company's small IT team having to analyse parts of its security in isolation, which makes the process of resisting and dealing with attacks a seamless process.
"Because we're a small team, we can now concentrate on business growth, launching new products, ongoing development, improving the website as a whole, [without having to] worry about whether we're doing security," King said.
"Because of the speed, the way it grows and the way it interacts with our Amazon environment, we're not slowing down our dev team in any shape or form."
FunkyPigeon.com hasn't had to take on any more staff to keep an eye on its security and can make sure it's protected 24 hours a day, seven days a week, 356 days a year.
AlertLogic's Cloud Insight solution has helped the company identify internal vulnerabilities and reduce them by around 50% so far with an ongoing plan to reduce this further, which is a huge bonus.
The future of the relationship
"Moving forward, FunkyPigeon.com will continue the use of the Alert Logic solution and it's deployed as standard to any new workload we set-up. Also, as we migrate additional workloads to the cloud, the AlertLogic solution will be included," King said.
FunkyPigeon.com will look into whether AlertLogic can be deployed across the whole group of business both in the UK and abroad to provide a single source of information around its security status.
"We view our relationship with AlertLogic as a long term one and will continue to work with them to ensure our security is best of breed at all times," King commented.
"Cloud security is ... about highlighting to people that basics are done. It's moving forward and extra layers of security need to put on to help deliver extra areas that businesses require so that cloud - which, let's face it, is the way forward - can be utilised by everybody."
