Could the Colorado Rockies' site crash have been prevented?
If you follow either baseball or IT infrastructure, I'm sure you're aware of the crash of the Colorado Rockies' web server, shortly after they started selling tickets for the World Series games. The site is back up, although the company isn't admitting to the actual source of the problem other than to say that they were "the victim of an external, malicious attack that shut down the system."
Journalists are known for shoving their microphones (virtual and otherwise) into the middle of a disaster and asking the victims, "How do you feel?" I haven't called anyone at or their partner Paciolan (the service that actually runs the e-commerce site). Aside from the fact that they're in the middle of a technology and PR firestorm, with the company located in Irvine, California, I think they have another kind of fire to put out right now. (How kind of me, huh?)
Instead, I've found myself contemplating the IT and business issues. By its nature, ticket sales for the World Series must be the worst kind of load testing nightmare imaginable: a sputter of traffic followed by several million people who want to witness whether Matt Holiday will actually be able to touch home plate this time. But if the ticket sales site was the victim of a malicious attack (and my cynical side whispers, "Sure sounds better to say that than to admit they screwed up, doesn't it?") — could they have done anything to mitigate the problem?
You probably don't have to cope with millions of angry customers... but if your server went down at a critical time, the result might be equally devastating.
What—if anything—could the IT folks at Paciolan have done to prevent this from happening? Was this a failure of load testing? Did they choose the wrong architecture? What lessons can you learn from their misfortune?
The architecture, first: The company doesn't say much about the technology it's using, but thanks to a smart correspondent on the Software QA Forums, it's easy enough to find out from their job search listings: currently Pick/Universe but moving to J2EE, with some uncertainty about the database to use.
Though I doubt the problem had anything to do with their platform. According to performance testing consultant Roland Stens, the site probably suffered a Distributed Denial of Service (DDOS) attack or automated scripts hitting the site trying to snatch tickets. And, say Stens, they tried to minimize this by blocking IP addresses that had repeated requests for the same info:
"Alves explained that those who saw a "page cannot be displayed" message had "IP addresses that we blocked due to suspicious/malicious activity to our website during the last 24 to 48 hours. As an example, if several inquiries came from a single IP address they were blocked."
Said Stens, "This, effectively, also blocked traffic from sites with multiple users that use only one external IP address"—which most companies do. Stens also pointed out that Paciolan's online ticketing brochure promotes their solution as "Power up your ticket sales, with the industry’s most robust online ticketing solution." This, he remarked, has obviously and painfully been contradicted.
DDOS attacks are not rare. Brian Karas, who's built several high availablity server farms, offers several specific suggestions. "This can be a particular weak point in many modern web servers because the content is often dynamically generated or pulled from a
Previous Post: An Open-Source Project with a Marketing Team. Imagine That.Next Post: A Note from Your BlogMom
What is Tech Briefcase?
TechBriefcase is a new, free service where IT Professionals can Search, Store and Share IT white papers and content like this. Learn more
Bookmark content
Speed up your research efforts with content across the web.
Search and Store
Find the white papers you need. Create folders for any topic.
View Anywhere
Open your briefcase on your iPhone, tablet or desktop. Share with colleagues.
Most Discussed Posts
Cloud computing has emerged as one of the most significant game changers to hit the technology landscape in the past 20 years. With this massive expansion of the cloud, the perception of the IT organization is shifting from a utility player to a change agent. This eBook breaks down five ways progressive organizations are using cloud-based IT Management solutions to help drive innovation and become more strategic, including: adding visibility and analytics, speeding up time-to-value, lowering costs, improving prioritization, and providing a blueprint for future cloud deployments.
Read the white paper to see how IBM helped Citigroup deliver new services and enhancements to their 200 million customers faster.
There are 3 ways to modernize legacy applications: rewrite completely, acquire packaged solutions or migrate existing code. This paper explains why it's best to migrate and how IBM® Rational® software can help.
Accommodating specific lines of business can result in a hybrid ecosystem of applications and servers. The resulting complexity of this architecture makes for an environment that is costly to maintain and difficult to change when addressing new challenges.
This whitepaper will help you to define a mobile device passcode policy. Security managers must attempt to reconcile two opposing goals. They must: 1) create a passcode policy that is strong enough to protect the device if it is lost or stolen, while: 2) not annoying users with needless length or complexity.
This whitepaper, authored by The Radicati Group, looks at the key reasons organizations should consider moving to a cloud-based archiving solution. Email archiving solutions enable organizations to store, monitor, and collect electronic data exchanged by their users to comply with internal policies and regulations.
ATERNITY will showcase a 30-minute demo on how Fortune 500 companies are leveraging its award-winning FPI Platform to deliver a user-centric approach to Proactive IT Management.
For businesses to move forward and tap into the ever-expanding universe of Internet users and network-enabled devices, it's critical to learn how to make the transition to IPv6. Learn the critical steps your organization must take to make a seamless transition-and keep your business world connected.
Learn how IT teams can protect against spear phishing tactics. Harry Sverdlove, chief technology officer of Bit9 offers a frank discussion about spear phishing - the most common technique used in today's advanced attacks.
Learn how to build a solid business case for your migration to Red Hat Enterprise Linux so you can run leaner, innovate faster, be more flexible and own the New Now.
Social media isn't about you; it's about everything around you. As you consider how your customers want to communicate with you, social media is something that can't be ignored. But what should your strategy be? Is social media "just another channel?" What kind of a plan makes sense for your contact center and for your customers? Join our experts as they share their insight and research results.
Hardware tokens were a popular method of strong authentication in past years but the cumbersome provisioning and distribution tasks, high support requirements and replacement costs have limited their growth. The additional log-in steps that hardware tokens require and the resulting user frustrations have limited adoption and make them impractical for larger scale partner and customer applications.
Sponsored Links
