Design to protect availability
You should find the right balance between keeping things running smoothly and keeping them secure. The system should always be up so people can get to the data they need. But at the same time, only the right people should have access, and the data should be trustworthy. Security controls should block bad actors but not slow down legitimate users.
Example scenario
Contoso Concierge runs a hotel management software system used by over 50 hotel brands across the United States. It handles bookings, check-ins, guest services, and housekeeping. The system is cloud-based, runs in two United States regions, and is mostly hosted on virtual machine scale sets. Hotel staff access it through a browser.
Enhance reliability through robust security
Use security controls and design patterns to stop attacks and bugs from overloading the system or locking people out.
This approach helps keep the system up and running, even if someone tries to take it down with something like a distributed denial of service (DDoS) attack.
Contoso’s challenge
- The workload team and the workload’s stakeholders know that this system must be extremely reliable because hotel guests rely on it for both business and leisure travel. If it goes down, hotels can’t run properly.
- The team has put a lot of effort into testing functional and nonfunctional requirements to make sure the system works well and stays operational, including using safe ways to roll out updates.
- They’ve focused on keeping things reliable, but they haven’t paid as much attention to security. A recent update had a bug that hackers took advantage of, crashing the system for several hotels. The attack overloaded servers in one region for over four hours, causing major problems for guests and staff.
- The attacker used the app’s servers to sneak in requests to a regional storage system and pull up fake folio data. One of those fake folios was huge and caused the servers to run out of memory. Then, when users tried again, it spread the problem to all the servers.
Applying the approach and outcomes
- The team changed the design so the app servers no longer handle folio requests directly. Instead, they’re using a Valet Key approach to limit access. This approach wouldn’t have stopped the attack completely, but it would have kept the damage contained.
- They also added better input checks to clean up anything suspicious before it reaches the system.
- With stronger input filtering and a smarter design, they’ve reduced the risk of this kind of attack happening again.