Safe Travels: Travel Company Puts Cybersecurity Protection First

Amadeus Leisure IT is a travel company that has been on quite a journey of its own.

Starting life as TravelTainment in 2000, the company gained so much success as the main booking engine technology for the German leisure travel market that it was acquired by behemoth Amadeus Leisure in 2006. Today, known as Amadeus Leisure IT, the travel company serves 90% of the German travel market and an increasing amount of the travel market in other countries.

It has about 350 employees and six branches servicing travel agents, which use the software to book travel for their customers. Its database includes more than three billion travel options. In high season, it is responsible for about 13,000 leisure bookings with sales value of up to 20 million euros ($23.8 million) each day.

That kind of success didn’t happen overnight. Back in 2000, the company ran out of a small office, powered by a few servers in the basement. At the time, the only cybersecurity protection it had was the most basic—changing root passwords and installing local firewalls, said Thomas Beyer, unit manager of infrastructure at Amadeus Leisure IT.

By 2009, as the company grew and handled more sensitive customer data, it became clear that more security was needed. To manage these requirements, Amadeus Leisure IT added DefensePro, an intrusion prevention and detection device from Radware, to its growing on-premises data center. The appliance uses distributed denial-of-service (DDoS) prevention, protection and internet of things (IoT) botnet attack mitigation to defend against a variety of threats.

As the first entry point into the infrastructure, the device keeps attacks at bay by scanning ports and using cookies to confirm whether the traffic is legitimate. Potential vulnerabilities are addressed by the daily updated signatures Radware provides.

“If our company goes down, 90% of the German travel market is down because all of the big portals use our services,” Beyer said. “It’s our Plan B—our peace of mind.”

The Radware device proved even more useful when, just a few years later, a PCI compliance audit pointed out a requirement for an intrusion detection or prevention system (IDS/IPS). The auditor said Amadeus Leisure IT couldn’t continue business without one. Because DefensePro already qualified, the company was ahead of the game.

To ensure that it had enough protection against volumetric attacks, Beyer’s group chose to add Radware’s Cloud DDoS Protection Service to the mix. That way, the traffic would flow from DefensePro to the cloud DDoS and then be diverted to a Radware scrubbing center (which segregates and cleans DDoS attack traffic), taking the pressure off of the on-premises device.

A potential compromise also activates the Radware response team, which analyzes the situation and informs the manager on duty of any anomalies that warrant further investigation or switching to the cloud-based solution.

Today, DefensePro and Cloud DDoS Protection Service work in tandem, with Cloud DDoS Protection Service providing a failover capability for DefensePro. Working together ensures that valid traffic can get through so business is not disrupted.

Over the past few years, Amadeus Leisure IT has added more cybersecurity functionality, including antivirus and logging mechanisms from Splunk.

Next up is an anticipated move to the public cloud, away from its on-premises infrastructure, which currently consists of 3,000 to 4,000 virtual or physical servers. The move is in line with the broader Amadeus company, which aims to have virtually everything in the cloud within three years.

“We want to extend to other markets, both in Europe and beyond. Cloud will give us the reach and flexibility to expand,” Beyer said. While it would be easiest to use Radware technology to accomplish the move, Beyer said the company still hasn’t made a final choice.