As security threats have evolved over the past ten years, online retailers have been under increasing pressure to protect digital properties without impacting performance levels, all on a budget.
The performance and reliability of websites has become so critical for retailers that reconciling with the performance demands of customers and providing adequate security measures has become a tug of war for some.
The hacking community does not rest on its laurels; threats are doubling every year. Distributed Denial of Service (DDoS) attacks and SQL injections now account for more than 50 per cent of attacks, according to the Imperva hacker intelligence initiative. For e-commerce sites, an attack of sufficient severity can not only slow sales, but prevent completed transactions entirely.
Overwhelming a website to cause denial of service to legitimate traffic is only the beginning. Stealing Personal Identifiable Information (PII), mining sites and databases for corporate or state secrets and stealing intellectual property are all ‘fair game’ for today’s attackers.
Just having an opinion or association with a cause that perpetrators place a value on can make you a target for DDoS attacks. The recent debates on piracy bills such as SOPA saw organisations supporting legislation experience an increase in web attacks.
Security professionals believe they need to spend more time and money protecting their web assets, but in reality budget and resources are finite.
The other challenge is, the more complex a security infrastructure becomes, there is an impact on performance, which when related to operational efficiency can actually be more costly than an individual attack.
Some companies have employed services such as ‘traffic scrubbing’ and re-routing, but this impacts performance as traffic travels further, and incurs a performance degradation. The result of this is that some companies have even resorted to turning on these services once they are aware of an attack!
There are no silver bullets in security but attacks that are massive in scale and distribution need to be controlled by security infrastructures that can dynamically deal with those challenges. An architectural change is needed and the cloud is becoming the best answer to these distributed cloud-based security threats. It can act as a punch bag absorbing attacks away from the network perimeter, whilst allowing genuine traffic through. Cloud can maintain website performance whilst scaling dynamically to suppress attacks that are changing.
Moving to cloud-based security is not an easy psychological transition to make, even if the benefits are compelling; there is a ‘box hugger’ in all of us to one degree or another. Attackers are embracing methods the cloud is best positioned to deal with and it is now virtually impossible for all but the largest organisations to fund the in-house security needed to keep large attacks at bay.
Security and performance do not have to be at odds with one another, but to achieve the optimal balance, it is necessary for us all to think outside the network and the box – you can already see the hackers doing it.
John Ellis is enterprise security director, Asia Pacific and Japan (APJ), Akamai Technologies.