eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Bitly is one of the world’s most popular Web address shortening services, shortening over a half billion short links a month. Keeping Bitly’s infrastructure running and secure is no easy task, requiring a robust infrastructure and a comprehensive approach to information security.
In an interview with eWEEK, Rob Platzer, CTO of Bitly, explained how his organization delivers and secures its Web address shortening service. As CTO, Platzer’s responsibilities include technical strategy and engineering for how Bitly delivers technology to drive the business. He’s also responsible for all of the security concerns for the Bitly platform.
“We integrate security into every aspect of our software development, whether it’s the DevOps infrastructure level or the software engineering level,” Platzer said. “We don’t have a secure application unless we have both a secure network as well as a secure product.”
From an infrastructure perspective, Bitly operates out of a pair of data centers, including a co-location presence in Verisign’s Delaware facility. Verisign manages root DNS for the Internet, as well as being the domain registrar for the dot-com domain space.
“They have an incredibly secure and top-notch data center as well as a great team for managed services,” Platzer said.
Bitly also leverages Verisign’s distributed denial-of-service (DDoS) services to help limit the risk of attacks, according to Platzer.
Bitly’s second data center is used for emergency failover, as well as research and development. The additional resiliency is required as Bitly aims to deliver 100 percent uptime for short link decoding. Bitly refers to creating a short link as encoding and clicking on a link and being directed to the proper location as decoding, according to Platzer.
“We guarantee a higher degree of uptime for decode, so in the event that we have a catastrophic failure in our primary data center, the Internet doesn’t break,” Platzer said. “Bitly has become such a part of the Internet that if Bitly were down, then a huge swath of the Internet would cease to function.”
In the unlikely event of a catastrophic failure of decoding operations at Bitly’s primary data center, the company enacts what Platzer referred to as “Plan Z.” The “Z,” as the last letter of the alphabet, means that everything else has failed, he said. As part of Bitly’s Plan Z, there is a failover to Bitly’s second data center, which is located on Amazon EC2.
The May Attack
In May, Bitly publicly admitted that its service was compromised in a malicious attack. For Platzer, there were two big takeaways from the incident. The first was that transparency is key.
“Our users appreciated the level of transparency that we maintained throughout the entire incident,” he said.
The second key takeaway was that because of the attack Bitly has shored up its relationships with the security community.
Before the attack, Bitly participated in conferences and worked with other companies on security issues, according to Platzer. Now, “in the wake of that security incident, we really built the relationships where now we work very closely with the security teams at Facebook, Dropbox and Symantec, and we’re shutting down spammers and phishing attacks,” he said. “The sense that I get is that the community has really been coming together around data breaches, spamming and all the nefarious activities that are happening on the Web.”
User Security
One of the ways that Bitly has further improved security for users is by adopting two-factor authentication. With two-factor authentication, a second password or factor is required before a user can log in, making it more difficult for an attacker to gain unauthorized access to a user account. Additionally, Platzer said that Bitly added an auditing feature that enables a user to see all the authentication attempts on the user’s account.
“So you can see every log-in attempt and the IP address that it came from, which helps our users see if something doesn’t appear quite right,” he said.
Bitly can also potentially be used by an attacker as a service to shorten a malicious link. Platzer said that Bitly’s role is not to censor users, but rather to protect them.
“We have built some technology to automatically detect spam and flag it,” Platzer said. “We also proactively work with other security groups at other companies, where we trade information on spammers and we shut the links down.”
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.