Physics Wallah Enhances Security, Improving Student Experiences While Democratizing Learning Across India Using AWS

Physics Wallah (PW) is an education technology (EdTech) company in India. It provides online classes for elementary and high school students, helping many prepare for university entrance exams. Approximately 15 million students have downloaded the PW app to their smartphones, with over 2 million using its online education services daily. Students have access to more than 14,000 video lectures and 80,000 practice exam papers.

PW launched in 2020 with one exam category and one subject. Today, the company supports 2.7 million students across more than 40 exam categories and has established over 100 smart offline learning centers. Devesh Mishra, chief technology officer at Physics Wallah, states, "We want to continue democratizing and transforming the education landscape in India to give more people access to quality education and opportunities."

Since its inception, PW has been running its education platform on Amazon Web Services (AWS), using Amazon Elastic Compute Cloud (Amazon EC2) for applications and Amazon Simple Storage Service (Amazon S3) to store data assets like videos and exam papers. As PW grew, the number of distributed denial of service (DDoS) attacks and unauthorized access attempts increased to millions per day. To combat these threats and reduce the risk of internal users accidentally deleting content or providing unauthorized course access, PW sought to strengthen its platform defences.

PW worked with AWS Solutions Architects to strengthen the platform’s security. Together, they developed a custom security solution to protect applications and data without affecting performance or increasing infrastructure costs. According to Mishra, “AWS understood that security is a top priority for our business and provided the support we needed to elevate our protection.”

PW improved the security of its Amazon S3 data repositories by implementing bucket and service control policies to enhance access control. It also deployed storage encryption and multi-factor authentication to prevent accidental deletions. Using Lambda@Edge, the company implemented attribute-based access control for added security. Additionally, by integrating Amazon S3 Object Lock, it ensured that stored data objects could not be overwritten or deleted during their retention period.

Next, PW strengthened access control on Amazon S3 repositories by delivering data through Amazon CloudFront, where requests are authenticated using origin access identity, thereby protecting Amazon S3 from direct access.

The company utilized AWS WAF to defend its web applications against common threats and AWS Shield Advanced to enhance application availability and responsiveness during DDoS events. Together, these services monitor and block web traffic that poses threats to the platform, including mitigating bot traffic to PW’s websites and mobile apps.

By strengthening the platform’s protection, PW effectively blocks attempts by unauthorized users to gain access. Within 8‒9 months of enhancing its protection, the platform blocked approximately 250 billion access requests from unauthorized users in the last quarter. Additionally, AWS WAF blocked over 315 million requests from malicious IP addresses targeting PW's live web application—and successfully identified and mitigated over 35 attacks—in three months.

Other improvements included a 15 percent decrease in unauthorized referrals facilitated by Lambda@Edge, along with a 400 percent reduction in response time to DDoS attacks. Additionally, by mitigating server spikes caused by DDoS attacks, PW avoided sudden increases in its Amazon EC2 compute costs.

“Working closely with AWS, we significantly strengthened our system's defenses against external attacks and content piracy, which has resulted in substantial time and cost savings,” says Mishra.