Innovative Retail Technologies

MAR 2013

Innovative Retail Technologies (formerly Integrated Solutions For Retailers) is the premier source for innovative yet pragmatic technology solutions in the retail industry.

Issue link: http://dig.ismretail.com/i/110527

Contents of this Issue

Navigation

Page 33 of 37

Case Study Loss Prevention/Security WorldofWatches.com Conquers Cyber Attacks The online retailer is able to save thousands of dollars by using an on-demand DDoS mitigation company to handle large network attacks. by Bob Johns W hen you are an e-tailer, any downtime cuts directly into the bottom line, particularly if it is due to a cyber attack. Unfortunately, this is what happened to Swiss Watch International's (SWI) WorldofWatches.com site on several occasions, and it's not an unusual occurrence in today's world. SWI is a $130 million multinational watch company, based in Hollywood, FL, with strong roots in wholesale and direct retail sales. Despite the site's popularity, it had been relatively immune to cyber attacks and distributed denial of service (DDoS). SWI's CTO, Darin Grey, who has been with SWI since 2006, knew the company's firewall could handle the majority of attacks websites are subjected to every day, but sometimes an attack is more than the firewall can withstand. The first time the website was subjected to an attack that overwhelmed the firewall, leading to a complete denial of service, Grey looked into DDoS mitigation providers and found Prolexic, a global leader in DDoS protection and mitigation. At the time, SWI decided against using Prolexic. "Due to the cost and the fact that we had to first upgrade our existing hardware firewall solutions, we hesitated on going with Prolexic at the time," Grey says. "In hindsight, the cost of mitigation is a lot less than lost sales and consumer confidence." The Real Cost Of An Attack On Your Website His view changed one Saturday evening in December 2011, during the peak holiday season. At around 10 p.m., a 130 MB bandwidth flood was directed at the WorldofWatches.com site, far exceeding network capacity. Grey says, "With the amount of traffic being pumped through at that time of night, no one at our hosting facility could help us out." SWI had other sites running on the same network, so this one attack brought down multiple websites for approximately 12 hours. It was then that SWI's CTO knew he needed outside help. On Sunday morning, Grey contacted Prolexic about emergency provisioning and mitigating the attack. "The incoming attack was being blocked by the upgraded firewall, but it was still flooding the network," Grey laments. "When we contacted Prolexic, they were able to mitigate the attack in minutes. "Our company is growing significantly every year, so any downtime costs more than the time before," Grey notes. None of this takes into account the possible damage to the company's 34 RetailSolutionsOnline.com ● March 2013 reputation with its loyal customers. When a website is down or hacked, consumers tend to worry about the security of their data, especially when identity theft is still a worldwide problem. Minimizing The Cost Of An Attack The process consisted of Prolexic, a DDoS mitigation company, providing WorldofWatches with a virtual IP address to use during the attack. WorldofWatches techs then redirected all traffic to the virtual address. From there, all of the traffic was scrubbed by Prolexic, and only legitimate traffic was rerouted back to the actual site. "We were back up and running in minutes, and the legitimate customers didn't notice any irregularities on their end," Grey states. By using this process during an attack that occurred at one of the worst possible times of the year, the cost of lost sales was minimized. There was a subsequent attack, and this time the attackers went after the IP, rather than the domain. Due to this change in attack style, Prolexic and WorldofWatches had to work directly with the network provider to accept only scrubbed traffic from Prolexic and to deny everything else. This strategy worked once everything was put in place, and the WorldofWatches site was back up quickly. With Prolexic's network standing between WorldofWatches. com and incoming DDoS attacks, Grey is confident about long-term site availability. Using a cloud-based on-demand DDoS mitigation provider, SWI is able to control the overall costs associated with DDoS attacks. The company does not have to add hundreds of thousands of dollars worth of servers to handle traffic flooding. The company can rely on its own network provider and the DDoS mitigation company to separate and reroute all of the legitimate traffic. The SWI tech team is now able to recognize when it cannot handle an attack much earlier, reach out to Prolexic, and proceed with the best mitigation strategy right away. "In e-commerce, every second of downtime is an opportunity for your customer to go somewhere else, and it is very tough to get a customer back," Grey says. "With the number of options today's consumer has, we have to be up and running all of the time. That is why we have an upgraded firewall and increased server capacity to handle most attacks on our own, and an on-demand provider to help when the attacks grow beyond our control." ■ For More Information On Prolexic Go To www.prolexic.com

Articles in this issue

Links on this page

Archives of this issue

view archives of Innovative Retail Technologies - MAR 2013