Cloud security helps Perisher avoid the slippery slope of non-compliance

With no tolerance for interruption of critical online sales during the critical four-month ski season, alpine resort Perisher has boosted its information-security profile after introducing a cloud-based security tool that has built a protective crust around its online services and helped ensure compliance to payment-card standards.

Perisher’s online infrastructure is based on a handful of servers that handle a growing volume of online sales and customer interactions – which in recent years have played an increasing role in helping the resort speed customers’ planning of the journey from their home onto its slopes.

Reflecting the growing expectations of Payment Card Industry Data Security Standard (PCI DSS) compliance for organisations handling credit-card information online, Perisher had worked in recent years to ensure its information-security protections were up to PCI requirements. This has led the company to continually look for new ways of boosting its systems security.

Because their online presence has been increasing, the Perisher resort wanted to add an extra layer of security that would enhance standard protections like server-hardening firewalls. Their focus was on making sure they did everything possible to protect the network.

After the resort’s servers were last year targeted by a spambot – which flooded its forms-handling server with thousands of emails in a short period of time – it became clear to the six-person IT team that a novel security approach would be beneficial.

The team evaluated a number of intrusion-prevention systems and eventually settled on Incapsula, a cloud-based Web application firewall (WAF) service from Imperva that continually tests the Perisher site for any holes and issues, with weekly reports highlighting any areas that would benefit from attention.

“We can make sure we haven’t missed anything as we make changes to the site,” a spokesperson said. “We can run another PCI compliance scan and action any issues we find, and it’s a lot easier for us to organise than relying on the banks to do repeated audits.”

Rather than trying to handle security filtering on its servers, the cloud-based solution has allowed the organisation to offload the filtering process without impacting performance – and by tapping into the continually-accumulating threat knowledge within the Incapsula solution.

Perisher routes all Web traffic through the platform, where it is scanned and filtered against PCI requirements. Compliant traffic is shunted back onto the Perisher network, while problematic traffic – for example, cross-site scripting and SQL injection attacks – never enters the resort’s network.

Use of a cloud-based security tool not only helps keep malicious traffic off the network, but resolved a platform challenge because any on-site solution would have needed to run on both the Windows and Linux servers on which Perisher relies.

Because it has been designed with PCI compliance in mind, Incapsula automatically generates necessary compliance reports that save the Perisher team time and effort that can be focused on other parts of their infrastructure.

Early testing demonstrated the solution’s value during evaluations last year, but Perisher waited until Imperva opened an Australian hosting facility before implementing the solution, to ensure that the system didn’t introduce any unwanted latency. A two-week trial demonstrated that the local servers were offering acceptable latency, and Perisher went live with the solution before the commencement of the current snow season.

“The overall main point was to add additional security to our services given that our online presence is continuing to grow,” the spokesperson said. “Our online presence is a big thing, and for four months of the year everything is under a very fine microscope. You've got a very short period of time to make your business income – and you just need to make sure everything is working.”

Follow @CSO_Australia and sign up to the CSO Australia newsletter.

Join the CSO newsletter!

Error: Please check your email address.

Tags cloud securityperisher

More about CSOImpervaLinux

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by David Braue

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place