Hands-On Security in DevOps

Summary

In this chapter, we discussed some typical business fraud and abuse cases, including account cheating, online scalpers, non-genuine orders, and account takeovers. The major categories of business fraud risks are accounts, content, payments, and promotion.

We suggested some detection rules and typical frameworks for building your own business risk detection services. To identify normal and abnormal user behavior, we need to build a user profile. Aspects of profiling include IP profiling, device fingerprints, machine behaviors, accounts, and usage.

In addition to detection, we also explored some mitigation approaches, such as PCI compliance, the threshold, 2FA, CAPTCHA, GeoIP, and IP reputation. Last, but by no means least, the prioritized ...