Strengthening Protection Against Bots and DDoS Events While Reducing Costs Using AWS WAF with Moovit

Moovit, a subsidiary of Mobileye, is an Israel-based software company that offers an app for navigating across public transit modes, including buses, rapid transit, and more. Moovit’s app is powered by its public APIs, but that availability increases the risk of bot and DDoS events. “We needed a solution that was both public and secure,” says Eli Rapoport, chief information security officer at Moovit. The company was using an external load balancer and a WAF from a third-party provider. However, with bots and DDoS events becoming more frequent and severe, the company was looking to enhance security and resiliency.

Moovit has been using various AWS services for years, and it decided to migrate to AWS WAF to take advantage of AWS WAF Bot Control, which provides visibility and control over common and pervasive bot traffic. “Expanding the coverage and making sure all public-facing endpoints are protected by a WAF was much simpler to achieve using AWS WAF than the previous solution,” says Rapoport.

Then, Moovit began using Amazon CloudFront, which securely delivers content with low latency and high transfer speeds, as its content delivery network. Now, all requests reach Amazon CloudFront first, while AWS WAF and its load balancers defend against any unwanted traffic. Next, Moovit adopted AWS Shield Advanced, which provides higher levels of protection against events targeting applications on AWS. The company configured automated rules through AWS Shield Advanced that learned the normal patterns of API use. Now, those rules detect anomalies automatically to proactively block DDoS threats.

Most of the migration was done within 1 month, and the entire project was completed in 2 months. “We migrated to AWS WAF because of the ease of using it and its excellent integration with our cloud environment,” says Rapoport.

On its new architecture, Moovit can more effectively handle malicious bot traffic and protect its cloud environment. The company has seen a 75 percent decline in DDoS events that require manual intervention per quarter. It can also take advantage of DDoS cost protection, 24/7 access to the AWS Shield Response Team, and threat intelligence feeds using AWS Shield Advanced. “The ability of the AWS Shield Response Team to come into an incident and take an active part in the response was very important to us,” says Rapoport. “The team provided us with high-quality recommendations when we were faced with a DDoS event.”

With customers around the world, Moovit used to incur high DTO costs with its external load balancer. Because Amazon CloudFront is available around the world, customers now get data from the region that’s closest to them. As a result, the company has reduced DTO costs by 50 percent.

Another priority was protecting against data scraping. The company has found that the AWS WAF Bot Control feature intercepts more data scraping attempts than its earlier security solution. And whereas the old system could protect against simpler DDoS events, AWS WAF Bot Control can stop more sophisticated events, such as when outside parties use IP addresses of good repute or change parameters between requests.

Meanwhile, Moovit has more visibility and observability into its infrastructure. “It’s much simpler to understand your security coverage when you’re using AWS WAF instead of an external solution,” says Rapoport. The company has enhanced log analysis for specific events that it wants to look at more closely. It has created dashboards tailored to specific needs using AWS and other third-party tools for observability. Now, Moovit’s teams are using the logs to identify and investigate production issues.

The customers who depend on Moovit’s services are seeing benefits too. “We saw a big reduction in latency for our users, especially in regions in Latin America,” says Rapoport. Moovit uses Amazon CloudFront caching to enhance application performance by speeding up response times. In addition, DDoS events can’t overwhelm Moovit’s load balancers because Amazon CloudFront and AWS WAF stop the requests before they reach that point. That, in turn, improves the availability of Moovit’s applications.

“In our pursuit of a robust security framework, AWS stood out as the clear choice for our security enhancement,” says Rapoport. “By using AWS WAF, Amazon CloudFront, and AWS Shield Advanced, we’re proactively defending against malicious bot activities and DDoS threats. Our users’ safety remains paramount as we navigate the digital mobility landscape.”