Bot attack mitigation

Aikyam mitigates bot attacks by integrating Shape Security (F5 Bot Defense) as a dedicated security layer. Incoming requests to protected endpoints are routed through Shape Security, which analyzes traffic for bot patterns, adds security headers, and blocks suspicious activity before forwarding valid requests to the core platform.

• Shape Security Integration Aikyam uses Shape Security (now F5 Bot Defense) as a dedicated layer for bot attack mitigation. This is deployed on a fleet of EC2 instances behind an AWS Application Load Balancer (ALB), with traffic routed through CloudFront behaviors to the Shape Security origin for protected endpoints.
• Traffic Routing and Validation: Most API endpoints are configured to route requests first through Shape Security, which adds security headers and validates requests for bot-like patterns or risks before forwarding to the core platform. This ensures that nearly all tenant endpoints are protected, with only rare exceptions for specific use cases.
• Custom and Managed Rules: The platform leverages a mix of AWS managed rules and custom rules for bot mitigation, tailored to platform needs and implemented as code (Terraform). These rules are enforced at the edge via CloudFront and integrated with Shield Advanced for DDoS protection.
• Multi-Account Strategy: Shape Security workloads run in separate AWS accounts for production and non-production environments, ensuring isolation and governance.
• Monitoring and Observability: Bot defense effectiveness and traffic patterns are monitored using New Relic dashboards and Kibana, with metrics on blocked requests, attack detection, and system health.
• Continuous Improvement: The team adapts bot mitigation coverage as new tenancies and endpoints are onboarded, with ongoing integration of HealthSafe ID and other Optum entities.
• Access Control: Admin endpoints are not exposed to the public internet, further reducing attack surface for privileged operations.

This approach provides layered, automated, and adaptive bot attack mitigation for Aikyam’s identity platform.