CashFlows

Closing Security Gaps

When your company offers services aimed at maximizing payment success for customers and ensuring a safe place for them/their customers to do business, security is always top of mind. That’s the case for Mat Peck, CTO of CashFlows, a fast-growing, innovative provider of merchant payment solutions.

Processing payments for over 1,000 customers and powering more than 34,000 ATMs across Europe, the company has experienced significant business growth in the last few years. As a PCI-DSS level 1-approved payments provider, CashFlows is on the hook to keep cardholder and personal data safe for its customers and their customers. To that end, it takes every possible step to ensure it cannot be compromised by third parties or even its own employees.

Like a growing number of businesses, CashFlows is a SaaS company without a physical business presence. Its latest generation of omnichannel platform is entirely delivered via Amazon Web Services, a worldwide public cloud with its own security mechanisms. However, as Mat explains, “AWS hosts services for a living – it doesn’t protect those as its raison d’etre.”

Needing a World-Class Security Solution

Historically CashFlows worked with a third party that claimed it could provide better security than CashFlows could on its own. However, Mat discovered that wasn’t the case. CashFlows has policies intended to limit the attacks that reach its online presence and the scale of any compromise if it is breached. Even then, a relatively low-volume DDoS attack once managed to disrupt its services.

Since CashFlows delivers all its offerings – including its latest generation of products in the cardholder-present space – via the cloud, it cannot afford attacks that make its service unavailable. “Even if we are down for relatively short periods of time, our customers cannot receive payments for their services and will lose revenue. If our systems were unavailable for any sustained period, we would be out of business,” says Mat.

Knowing that DDoS threats aren’t going away, Mat wanted to find a reliable, far-reaching security solution. “We need to make sure anyone anywhere in the world can make local connections to our service, in a way that is resilient and incredibly protected.”

Akamai Augments CashFlows’ AWS Hosting

Aware that it has protected against many of the largest DDoS attacks in the world, Mat turned to Akamai. CashFlows could use services like Cloudflare via AWS but, as Mat describes it, Akamai is a superset to the Internet – delivering content locally and permanently inline.

Mat found that other cloud providers don’t offer the local nature of service that Akamai does. “It’s not just about having a large distribution in the cloud – it’s the value-add services on top of it that set Akamai apart,” he explains.

According to Mat, Kona Site Defender and FastDNS are extremely effective, reliable, and very powerful solutions. “Moreover, they’re simple to work with, always available, and backed with great, proactive service.”

Kona Site Defender runs on the edge servers of the Akamai Intelligent Edge Platform on a massive scale, with high availability and 24/7 monitoring. Mat realized that building equivalent services – a fundamental requirement of financial industry regulations – would be extremely costly and less effective.

“Even if CashFlows were to attract a massive amount of security threats, Akamai will stand alongside us and keep us protected no matter what. On the DDoS side alone, it’s reason to keep Akamai inline,” continues Mat.

Virtually Scaling Security via Akamai

As Mat describes it, Akamai allows CashFlows to block unwanted traffic and attacks against its API services, reducing noise and volume on its AWS platform. In the three years since deploying the Akamai solutions, CashFlows has experienced no security incidents or direct threats.

In addition, the Akamai solutions have significantly reduced load on CashFlows’ servers, resulted in fewer rejections at its API servers, and considerably lessened the noise from its IDS systems. “We have never hosted our own DNS but take comfort in knowing that because of Akamai, our resolution services would not be compromised or sacrificed if we were attacked,” he continues.

Mat also appreciates access to Akamai security experts. As he says, his team is focused on application security, yet threat patterns change continuously. “There’s a wealth of activity beyond our limited view of the world. We rely on Akamai to share its global view and help us determine how to best protect our environment. The security expert sessions allow us to ensure our systems remain one step ahead, and that our rule bases address the latest issues.”

Going forward, CashFlows plans to push further into new territories, add more payment methods to its platform, and introduce additional products such as gateways, data analytics and alternative payment mechanisms (APMs). It expects Akamai to deliver and protect all of that.

“As we move to a serverless, containerized setup, we want services running on multiple cloud service providers. With Akamai surrounding us like a security blanket, we’ll be better able to balance and route traffic accordingly,” he concludes.

About CashFlows

CashFlows aims to maximize payment acceptance for its customers and partners through more right-first-time sales, fewer declines and disputed sales. It does this through a combination of its purpose-built technology, innovation and expertise. CashFlow’s customers and partners experience this in action in many ways. From the company’s willingness to understand their problems to its tenacity in resolving them. From its speed at on-boarding new customers to its continuous improvement philosophy. Not to mention CashFlow’s secure, world-class innovation and technology. For more information, visit https://www.cashflows.com/.