In every system—including eCommerce systems, and even more so in those considered critical because of the business volume they generate—security is a factor to take very seriously.
There are different situations to assess, basically depending on the types of problems some attacks can cause.
We could distinguish two large groups: on the one hand, attacks against the system itself, that is, attacks that overload it with processing volume and make the service inaccessible to legitimate users; and on the other, bandwidth attacks, where the goal is to collapse the gateway to the system.
In both cases the result is that the service can’t be delivered due to saturation, and fighting these attacks can be difficult.
In the case of the first type of attack, as with everything in life, the more complex the attack, the more immune it is to possible solutions. The second type could be considered a brute-force attack, where whoever has the bigger one wins—the bigger bandwidth, I mean—since saturating an access point requires filling all the available capacity, so whoever has more volume will win the battle.
Given all this, it might seem that all we can do is pray we’re never targeted, but in some cases there are solutions, as I’ll explain below.
Bandwidth attacks
In these cases the only way to withstand them is to have the capacity to absorb the volume of requests that may arrive; there’s hardly any other solution.
Processing attacks
For this type of attack there are systems that detect browsing sequences, users with suspicious behavior, user addresses sending too many requests to the server and other behavior patterns, and block whatever these rules deem dangerous. There are even more advanced systems that “learn” from user behavior and generate live patterns on which to apply access restrictions.
The systems that perform these tasks are certainly expensive, but there are also more affordable solutions, since some companies specialize in offering these services.
The way it works is simple: all the requests the online store receives are routed through these systems, which act as a filter, absorbing attacks and blocking malicious requests.
