Microservices and API Security Enhancement for OFX’s International Wire Transfer Business
Technology Category
- Application Infrastructure & Middleware - Event-Driven Application
- Cybersecurity & Privacy - Application Security
Applicable Industries
- Electrical Grids
- National Security & Defense
Applicable Functions
- Quality Assurance
Use Cases
- Supply Chain Visibility
- Tamper Detection
Services
- Cloud Planning, Design & Implementation Services
- Testing & Certification
About The Customer
OFX is an international financial transfer platform based in Sydney, Australia. It processes over $22 billion annually through its web application. The company recently completed a total migration to the cloud over a period of three years. OFX's partners interact with the platform via APIs that communicate with microservices within the OFX network. The company was looking for a solution to increase visibility and protection against Open Web Application Security Project (OWASP) attacks and authentication abuse in its cloud-first microservices infrastructure.
The Challenge
OFX, an international financial transfer platform based in Sydney, Australia, processes over $22 billion annually through its web application. Having recently migrated to the cloud, OFX sought to increase visibility and protection against Open Web Application Security Project (OWASP) attacks and authentication abuse in its cloud-first microservices infrastructure. Partners interact with the OFX platform via APIs that communicate with microservices within the OFX network. The Head of Digital Security, Richard Lane, was tasked with building the security program and team. He aimed to ensure that their microservices weren’t implicitly trusting others and sought a product that would provide visibility. He wanted a solution that would be easy to install, use, and effectively block malicious traffic automatically, including logins, without causing production incidents.
The Solution
OFX deployed Signal Sciences in their mid-tier environment with an agent on their web servers. This allowed them to gain deep application visibility. Using Signal Sciences web server module plugins that communicate with lightweight agents, the security team and cloud architect were able to deploy easily without taxing the engineering team. After installing the software in minutes, the security team used Signal Sciences to uncover application errors and address root causes more efficiently and effectively. The quality assurance team uses Signal Sciences monitoring via easy-to-consume dashboards as a part of their release protocols to catch any issues quickly. They also used Signal Sciences Power Rules for successful and failed login attempts to establish a baseline for their normal authentication traffic. With a low risk tolerance and low traffic volume, OFX used Power Rules to create custom thresholds to alert and block malicious authentication traffic aggressively whenever it deviates from normal behavior.
Operational Impact
Quantitative Benefit
Case Study missing?
Start adding your own!
Register with your work email and create a new case study profile for your business.
Related Case Studies.
Case Study
Hydro One Leads the Way In Smart Meter Development
In 2010, Ontario’s energy board mandated that time-of-use (TOU) pricing for consumers be available for all consumers on a regulated price plan. To meet this requirement, Hydro One needed to quickly deploy a smart meter and intelligent communications network solution to meet the provincial government’s requirement at a low cost. The network needed to cover Hydro One’s expansive service territory, which has a land mass twice the size of Texas, and its customers live in a mix of urban, rural, and remote areas, some places only accessible by air, rail, boat or snowmobile. Most importantly, the network needed to enable future enterprise-wide business efficiencies, modernization of distribution infrastructure and enhanced customer service. To meet these needs, Hydro One conceptualized an end-to-end solution leveraging open standards and Internet Protocols (IP) at all communication levels. The utility drew upon industry leaders like Trilliant to realize this vision.
Case Study
Selling more with Whirlpool
Whirlpool wanted to add connectivity to appliances and transform the company's relationship with customers. Traditionally, Whirlpool interaction with customers was limited to purchases made once every ten years. Connected washer and dryers provide exciting new features like remote management of start times and inter-machine communication.
Case Study
SAS® Analytics for IoT: Smart Grid
Companies face falling revenues, rising infrastructure costs, and increasing risk of outages caused by inconsistent energy production from renewable sources. Less money is coming in as more people and organizations take steps to curb their energy use. Utilities are paying more to maintain and build infrastructure due to increasing complexity, resulting from the rising number of intermittent and variable renewable energy sources connected in the distribution grid.
Case Study
Enel Secures Italian Power Generation Network
Electric energy operators around the world are working to increase the reliability and cyber resiliency of their systems. This includes Enel, a global power company that manages and monitors the Italian power grid. This grid:• Serves 31 million customers• Has a net installed energy capacity exceeding 31 gigawatts• Includes more than 500 power generation plants,including hydroelectric, thermoelectric, and wind• Is managed and monitored by Enel 24/7/365• Is operated by Terna, the Italian Transmission System Operator (TSO)Enel is responsible for the availability of the grid’s underlying ICS and industrial network. It also manages Regional Control Centers and Interconnection Centers which connect with the TSO. The TSO manages the flow of energy to the grid plus controls and remotely regulates the power generation of power plants, increasing and decreasing power production as required. The complex system of interaction and cooperation between Enel and the TSO has strong security implications as well as operational and business challenges.
Case Study
IoT based Energy Quality Availability Monitoring Solution
There were several challenges faced:Since this data would be in the public domain, accuracy and authenticity of this data were of paramount importance. It should be able to withstand scrutiny.It is challenging to build an appliance that can withstand a wide range of voltage fluctuations from as low at 90v to as high as 320v. Since the device would be installed in remote locations, its resilience was of paramount importance.The device would have to deal with poor network coverage and have the ability to store and re-transmit data if networks were not available, which is often the case in rural India. The device could store up to 30 days of data.The platform that deals with the data should be readily available and highly reliable and never lose a packet of data.
Case Study
Data Capture for Afghanistan Forces
Electronic equipments on the field of Afghanistan provided information on the status of the vehicle and to identify potential threats surrounding it to the British Force. The monitoring and interpretation of this data requires robust and sophisticated digitization for data capture and communication.
