Challenges
- With so much traffic logging into the site via web and mobile, the company had no clear way to determine how much of that traffic was human and how much was synthetic bot traffic.
- Flybuys was particularly concerned about protecting its login pages from bot traffic and mitigating possible account takeover attacks and loyalty points abuse.
- Multiple businesses had suffered from DDoS attacks, enough to start the search for better solutions.
Results
- Achieve greater visibility into all of its traffic — human and synthetic (good or bad).
- Defend against bot-based attacks, specifically credential abuse and loyalty fraud.
- Reduce over 60% bad bot traffic to the site, resulting in better site performance.
- Stop account takeover attacks and protect member information to improve brand reputation.
Established in 1994, Flybuys is committed to serving its 8.7 million active members with new and exciting ways to engage with the travel and loyalty program. After 30 years, Flybuys has entered an exciting new phase of growth, with a renewed focus on product development and innovation to continuously improve their members’ experience.
8.7M
active members served by the loyalty program.
60%+
reduction in bad bot traffic to the site.
The Pain: No Visibility Means No Control
But with innovation comes challenge. With so much traffic logging into the site via web and mobile, the company had no clear way to determine how much of that traffic was human and how much was synthetic bot traffic. That’s an important distinction, as Flybuys was particularly concerned about protecting its login pages from bot traffic and mitigating possible account takeover attacks and loyalty points abuse.
While we had some internal capacity to monitor user credentials, we needed a better understanding of who—or what—was logging into our online properties. We were mostly concerned about synthetic traffic, and whether that traffic was being weaponized against us in credential stuffing attacks for account takeover.
— Anthony Martino, IT Operations Manager, Flybuys
Another way synthetic traffic can be used against a business’ online assets is through a distributed denial of service attack (DDoS), in which normal traffic is overwhelmed by malicious automation. “Multiple businesses had suffered from DDoS attacks, even though they were relatively minor,” noted Alex Loizou, Head of Security at Flybuys. “But it was enough for us to start looking for better solutions and that’s how Kasada came into view.”
The Solution: Kasada Bot Defense
Once Flybuys found Kasada, the company realized the company could also help protect against other forms of malicious automation, such as account takeover and loyalty points abuse, integrated as a single service. They entered into a proof of concept and immediately benefited, moving to full production shortly thereafter.
Kasada provides customers like Flybuys with visibility into all of their traffic, not just the bots stopped. Not only can Flybuys detect bot attacks as they happen but also gain critical insight into real customer traffic to improve the customer experience. Customers also use Kasada’s analytics to report accurate KPIs, optimize marketing return on investment, increase sales, and protect their brand reputation and shareholder value.
Kasada worked proactively with us to demonstrate the platform and its immediate value. From the moment we switched on the platform, there was immediate feedback on the number of page requests that were bot-driven, and I can tell you Kasada neutralized them from the very first page load request. When a bot attempts to attack us, it ends quite quickly. This has enabled us to provide a secure customer experience without the added friction normally found in other solutions.
— Phil Hawkins, Chief Operating Officer, Flybuys
The Gain: See All Traffic and Stop the Bad Bots
Flybuys chose Kasada based on its elegantly simple and superiorly effective technology, experienced team, and surprisingly affordable price.
The level of engagement we get from the Kasada team and the further investigations they have undertaken on our behalf to help us deal with threats has consistently exceeded our expectations. The solution works as advertised with an ease of implementation that is clearly different from the competition. We also appreciate Kasada’s behavioral-based approach. Even as we have undertaken re-platforming activities, Kasada has provided a secure, bot-resistant front door to all of our online assets.
— Anthony Martino, IT Operations Manager, Flybuys
Running on AWS
Kasada’s platform protecting Flybuys runs on AWS, leveraging Amazon EKS for real-time inspection, Amazon MSK and Apache Flink for telemetry processing, Amazon DynamoDB and ElastiCache for policy and session state, and Amazon S3 and Athena for secure analytics, while integrating with Amazon CloudFront, AWS WAF, and AWS Shield to protect Flybuys’ edge and application layer.
