Company Background

In just a few years, LeoVegas has grown from a new brand to the industry’s fastest growing mobile gaming company, propelled by the vision to create the best gaming experience and to be number one in mobile gaming.

Through, the company offers sports betting, dozens of slots, casino and live table games to more than 4000 players on average every day. With product development and tech teams in Sweden and licensed operations in the UK and Malta, LeoVegas’ future plans call for expansion into new markets.

Business and Technical Challenge

Committed to creating the ultimate mobile gaming experience for its players, LeoVegas invests ongoing efforts to improve the security, availability and performance of its website. These crucial operational areas directly impact the company’s bottom line, and command high-priority attention from senior management, as well as the IT and Operations teams.

“Our website is our business. From a player experience standpoint, it’s critical that we have uninterrupted uptime,” said Manuel Fuentes, head of security at LeoVegas. “If there is a service disruption or a login delay, our players will take their money and play at one of our competitors.”

In this context, reducing the risk of a DDoS attack against the website was a key business requirement. DDoS attacks are prevalent in the gaming industry, and often are initiated by angry or frustrated players. Although LeoVegas has yet to be targeted by such an attack, given its growth and industry position, Fuentes believed that it was just a matter of time before their site would be put to the test.

To protect against even the slightest service disruption, LeoVegas sought an always-on DDoS mitigation solution. The advantage of this type of deployment is instant mitigation from the first wave of any assault. However, to preserve the user experience, LeoVegas had to make sure that always-on DDoS protection would not add latency to overall website performance.

As LeoVegas’ business expands into more countries and markets, regulatory compliance has also become a top concern for its C-level executives. Each country demands more audits and has different compliance issues that need to be addressed. Accordingly, LeoVegas required a security solution that could support automated compliance reports and meet PCI-level standards.

Beyond the security aspect, LeoVegas sought a solution that could give it better visibility into its website traffic for marketing purposes. In particular, it needed granular breakdowns of human and bot traffic in order to measure the effectiveness of its affiliate marketing campaigns.

The Solution

Fuentes and his team began to search for a solution to address LeoVegas’ security and operational needs. The due diligence phase consisted of researching leading products, consultations with its distributor and conversations with a number of potential vendors. During these discussions, LeoVegas found the Imperva Cloud WAF team to be the most responsive and professional in terms of asking the right questions, understanding its requirements and suggesting practical and effective solutions.

LeoVegas decided to proceed with a trial evaluation of the Imperva Cloud WAF, where it encountered some onboarding issues related to SSL certificates that were quickly resolved with the help of the Imperva support team. “Looking back, dealing with this glitch was a very beneficial experience as it showed us how quickly the Imperva team reacts to problems. In addition, our IT team learned about what could go wrong technically and how to revert to previous settings when needed,” said Fuentes.

Today, LeoVegas is using the Imperva Cloud WAF service in live operations to accelerate and protect the website. The solution includes the Content Delivery Network (CDN), Web Application Firewall (WAF) and always-on Website DDoS Protection products. All traffic is routed through the Imperva network, which automatically identifies and filters out DDoS attacks, malicious bots and exploit attempts before they reach the LeoVegas site.

Since deploying the Imperva Cloud WAF service, LeoVegas has seen an improvement in website performance. “Several developers told me that they perceive the site to have better response times, based on testing they did after onboarding Imperva. We attribute this improvement to the global CDN, which eliminates any potential latency related to inspecting traffic through the WAF,” reported Fuentes.

Another major benefit of using the Imperva Cloud WAF is in the area of traffic analysis. “Imperva has been really great in helping us get a granular view of our website traffic, enabling us to understand how much traffic is coming from human visitors and how much from automated bots,” said Fuentes. This has allowed LeoVegas’ marketing team to optimize its affiliate-based campaigns.

“LeoVegas is a great example of an innovative market leader that truly understands the potential business consequences of a DDoS attack. Rather than scrambling for a solution when under attack, they opted for a proactive approach that allowed them to secure their online assets in an optimal manner,” said Marc Gaffan, General Manager for the Cloud WAF service at Imperva.

Results and Benefits

By using the Imperva Cloud WAF service, LeoVegas has achieved multiple benefits across the organization:

Enhanced security
Always-on protection against DDoS attacks and blocking of exploit attempts out-of-the-box using the Imperva Cloud WAF

Better visibility into website traffic
A highly granular view of human, good bot and bad bot traffic provides valuable input for LeoVegas’ marketing campaigns

Improved performance 
Imperva CDN caches content in data centers located close to LeoVegas’ players, accelerating response times as well as reducing bandwidth costs

Compliance friendly
Imperva Cloud WAF is Level 1 PCI-certified, with auditing and reporting capabilities as required in various markets