IS YOUR E-COMMERCE SITE READY FOR BUSINESS? UNDERSTANDING HOW SECURITY, AVAILABILITY, AND SCALABILITY CAN MAKE OR BREAK YOUR SITE.

Transcription

1 IS YOUR E-COMMERCE SITE READY FOR BUSINESS? UNDERSTANDING HOW SECURITY, AVAILABILITY, AND SCALABILITY CAN MAKE OR BREAK YOUR SITE. A White Paper Security, availability, scalability Page 1 RACKSPACE HOSTING 5000 WALZEM ROAD SAN ANTONIO, TX U.S.A Edited

2 IS YOUR E-COMMERCE SITE READY FOR BUSINESS? UNDERSTANDING HOW SECURITY, AVAILABILITY, AND SCALABILITY CAN MAKE OR BREAK YOUR SITE. Anyone can put up a website and start doing business online. But for an e-commerce website to support your business effectively, it must provide: Bulletproof security 24x7x365 availability Ready-for-anything scalability This white paper defines what today s online buyers expect in terms of security, availability, and scalability, then describes four options for managing a website, including one you may not have considered: managed e-commerce hosting. BULLETPROOF SECURITY E-commerce customers give online vendors their names and addresses, credit card numbers, maybe even Social Security numbers and medical conditions. Criminals out there would love to get their hands on that information. Security breaches can occur at many levels: Systems can contain vulnerabilities that hackers find and exploit Routine upgrades or system patches can open a window of opportunity for thieves Online shopping carts can expose customer information to online snoopers. Security breaches happen all the time, and your prospects often hear about them. Three quick examples: Fake anti-virus software dubbed scareware netted thieves at least $150 million, according to the FBI The Internet Crime Complaint Center has received more than a million complaints from consumers in the past 2.5 years Since January 2005, a reported 512,331,180 customer records were exposed on the Internet in the U.S. That s more than the entire population of the country, meaning some people have been exposed more than once! To keep the orders coming in, some e-commerce operators may overlook the need for tight security on every level: systems, operations, and facilities. Who wants to bother looking into all 200+ elements to secure a PCI security audit? But if your team won t attend to those details, who will? Security, availability, scalability Page 2 RACKSPACE HOSTING 5000 WALZEM ROAD SAN ANTONIO, TX U.S.A

3 24x7x365 AVAILABILITY Availability means how often a system is online and ready for visitors to use. As shown in Table 1, this can be expressed as a string of nines. Table 1: Measuring Availability Measure Known as Roughly this much downtime per year 99% Two nines 4 days 99.9% Three nines 9 hours (1+ full workday) 99.99% Four nines 1 hour % Five nines Five minutes (the goal of many sites) Note: Scheduled downtime for system maintenance, upgrades or backups is not included Source: Oracle Database High Availability Architecture and Best Practices 10g Release 1 (10.1) June 2004, page 2-1 Availability is also in the eye of the user. An e-commerce system can be online, but if it s running too slow, visitors might abandon their shopping carts. For a nonprofit NGO that accepts a few donations through the web, a little downtime may not be serious. But if your enterprise relies on e-commerce for a major chunk of revenues, any lag or downtime can be a disaster. How long will shoppers wait around for your site to respond before clicking away to a competing site? A conservative estimate from Gartner pegged the cost of downtime at $42,000 per hour for an average business. E-commerce losses may be much higher. In fact, you can do the math for yourself, as shown in Table 2. Table 2: Calculating the Cost of Downtime Example: Big Deals Online Your Own Figures A: hour 1,000 B: % of transactions affected 100% C: Average transaction $42 D: Duration of downtime 6 hours Multiple A x B x C x D to find total business impact of downtime Total business impact $252,000 You can tweak your calculations if you know the time of day/day of week when downtime occurred, and the number and profitability of transactions that usually take place at that time Source: How to Quantify Downtime, NetworkWorld, 5 January 2004 As you can see, a single incident where a medium-range e-commerce site goes down for 6 hours can cost a quarter million dollars. And that s only for lost sales. The total cost will be higher, since these calculations make no allowance for other likely costs, such as: Loss of lifetime value of shoppers who go elsewhere Damage to brands Higher cost for pay-per-click campaigns Any site slowdown or downtime that causes Google to lower your page quality score will bump up the cost of your AdWords campaigns for a month or so, until your site shows better performance. Security, availability, scalability Page 3 RACKSPACE HOSTING 5000 WALZEM ROAD SAN ANTONIO, TX U.S.A

4 WHAT CAUSES DOWNTIME? Many factors can bring down your e-commerce site, anything from a squirrel nibbling on a power line to a severe storm. Computer scientists surveyed in 2010 said downtime is most likely caused by not adhering to best practices for the following: Change control Component monitoring Requirements and procurement Operations Avoiding network failures Avoiding application failures Avoiding external service failures Physical environment Network redundancy Backups To keep your site available, everyone on your team must follow the best practices for all these items every minute all year long. Do they? How many nine s did your site achieve last year? READY-FOR-ANYTHING SCALABILITY Scalability has been called doing what you do in a bigger way. In e-commerce, that means handling more orders from more people all at once. Even good news can be bad in e-commerce. If your site is lucky enough to be mentioned by a celebrity, can you handle the sudden spike in traffic? This so-called Oprah effect is enough to overwhelm many sites that are not built to scale quickly and smoothly. There are several ways to scale up an e-commerce site. You can gain more power by adding servers or larger hard drives. You can distribute processing through clustering, load balancers and virtualization. The easiest option is to sign up for a flexible service that automatically adds more capacity whenever you need it. Whatever you do, you must scale up every part of your system equally, including your web application, database, storage, load balancer, firewall, and so on. Otherwise, the single slowest element in your entire infrastructure may remain a chokepoint. Ask yourself these questions: Is everything behind your site designed to scale smoothly and evenly? Can your site handle an unexpected spike? Will special occasions and seasonal demands overload your systems? Planning for scalability demands thoughtful and disciplined forecasting. It s often tempting to focus on making sales today rather than building an infrastructure to support those sales tomorrow. If you don t have the strategy and architecture to scale up, what will happen when your site is faced with a surge of traffic? Security, availability, scalability Page 4 RACKSPACE HOSTING 5000 WALZEM ROAD SAN ANTONIO, TX U.S.A

5 FOUR OPTIONS FOR MANAGING E-COMMERCE WEBSITES There are four possible approaches to managing an e-commerce site: Do it yourself (DIY) Use an online shopping cart Use a third-party payment gateway Use a managed hosting service Option #1. DIY: Slow and Risky Some businesses choose to build their entire e-commerce systems in-house. As long as a company has all the expertise and necessary resources, this can work passably well for a modest-sized operation. In the long run, this can make adding new features and growing the site slow and frustrating. And the costs can be prohibitive, especially paying for a large team of programmers. Such a risky approach can stunt your e-commerce site s growth and profitability. Option #2. Online Shopping Carts: Underpowered Sites like Yahoo and ebay provide an online shopping cart with basic features. These usually perform well enough as simple cash registers, but they may not link well to your accounting or fulfillment systems. These systems lack real-time monitoring to show you what s going on. You may have to wait an entire day or longer before you even know there s a problem. A basic online shopping cart can simply be underpowered for your needs. Option #3. Payment Gateways: Costly and Inflexible Some e-commerce firms use third-party payment gateways like PayPal, 2Checkout, or ClickBank. However, it can be complicated to interface with these services. If there s ever a dispute, their policies can be as rigid as a brick-and-mortar bank. And like any traditional credit-card processor, these services take a big slice out of every transaction. What s more, do you really want an outside party setting your payment and refund policies or answering questions about some of your site s most important functions? Option #4. Managed Hosting: Could Be Your Best Option The fourth option might be best for many e-commerce operators: joining forces with an experienced managed hosting partner. The proper e-commerce host can power your website with bulletproof security, 24x7x365 availability, and ready-for-anything scalability. This partner can take care of all the details, while you focus on generating traffic and creating compelling offers. Professional hosting facilities can offer many benefits that may otherwise be impractical for mid-sized firms to implement themselves, says a recent report from the Yankee Group. Among these, it names reinforced buildings, backup generators, multiple network providers, and reliable cooling and fire suppression systems. Any seasoned e-commerce host will be PCI-compliant, so you won t have to worry about those frustrating details. Plus, your entire staff will be trained to eliminate the risk from social engineering. In terms of availability, a good managed hosting service will follow best practices across the board to cut the risk of downtime. They may be able to offer stress testing to help get ready for seasonal peaks and short-term spikes. Security, availability, scalability Page 5 RACKSPACE HOSTING 5000 WALZEM ROAD SAN ANTONIO, TX U.S.A

6 The best providers offer a set of incremental steps not an all-or-nothing solution. The solution should include scalable web and database servers, managed backup, and a payment gateway to balance the expectations of today s visitors with the realities of your budget. To find out how you can improve the security, availability, and scalability of your e-commerce website with managed hosting, visit www. rackspace.com/managed_hosting/ecommerce/index.php. ABOUT RACKSPACE Rackspace Hosting is the world leader in hosting. The San Antonio-based company provides its customers Fanatical Support in their portfolio of hosted IT services, including Managed Hosting, Cloud Computing, and and Apps. For more information, visit SOURCES 1: Pop-up Advertisements Offering Anti-Virus Software Pose Threat to Internet Users, Internet Crime Complaint Center (IC3), 11 December : The Internet Crime Complaint Center Hits 2 Million! 15 November 2010 retrieved 26 January 2011 from media/2010/ aspx 3: Privacy Rights Clearinghouse, Chronology of Data Breaches retrieved 26 January 2011 from htm 4: Tom Pisello and Bill Quirk, How to Quantify Downtime, NetworkWorld, 5 January : How does load time affect my landing page quality? AdWords Help, Google, retrieved 27 January 2011 from support/aw/bin/answer.py?hl=en&answer= : Ulrik Franke et al, Availability of enterprise IT systems: an expert-based Bayesian model, Proceedings of the Fourth International Workshop on Software Quality and Maintainability, 15 March : Royans K. Tharakan, What is scalability? Scalable Web Architectures blog, 22 September : Gary Chen, Disaster Strikes! Is Your Business Ready? Disaster Preparedness for Mid-Sized Firms, Yankee Group Research, February 2008, page 10 Security, availability, scalability Page 6 All rights reserved. This White Paper is for informational purposes only. The information contained in this White Paper is selected from public sources which we believe is reasonable in relation to subject matter and are believed to be accurate. RACKSPACE MAKES NO WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, AS TO THE INFORMATION OR SPECIFIC PRODUCTS. Users must take full responsibility for application of any product mentioned herein. Rackspace and Fanatical Support are service marks of Rackspace US, Inc. registered in the United States and other countries. Other trademarks and trade names appearing in this prospectus are the property of their respective holders. RACKSPACE HOSTING 5000 WALZEM ROAD SAN ANTONIO, TX U.S.A