The challenge
Fasset operates a blockchain-based asset tokenisation platform in the UAE fintech sector. The platform handles high-value digital assets and real-time financial transactions, making security and performance equally critical.
Several specific risks had to be addressed:
- Sophisticated cyber threats. DDoS attacks, credential stuffing, and automated bot traffic targeted the platform's API endpoints and user-facing interfaces.
- Global performance requirements. Real-time access to asset information and transactional data demanded low latency across a geographically distributed user base.
- High API traffic volume. The platform's API-first architecture required caching strategies that would not interfere with data freshness, plus robust protection for API endpoints.
- Operational visibility. Continuous logging and monitoring were essential for threat management and regulatory compliance in the fintech sector.
What Brixio deployed
Web Application Firewall (WAF)
- Managed rulesets tailored to protect financial data from SQL injection, XSS, and known vulnerabilities.
- Custom rules blocking suspicious activities identified during the security review.
DDoS Protection
- Enterprise-level DDoS resilience against volumetric attacks.
- Rate-limiting on login endpoints and API access to prevent brute-force attempts without impacting legitimate users.
Bot Management
- Machine-learning-based bot detection to mitigate non-human traffic.
- API endpoints protected from bot-driven abuse while allowing legitimate developer access.
CDN and performance optimisation
- Content cached across Cloudflare's global network for reduced load times worldwide.
- Tailored API response caching based on usage patterns and traffic types.
- Polish image compression reducing bandwidth by 30-40% while preserving quality.
- HTTP/3 enabled for reduced connection times on high-latency networks.
- Early Hints and Cloudflare Fonts eliminating third-party requests.
SSL/TLS and security headers
- Full HTTPS proxying with Cloudflare certificates.
- Origin server firewall restricted to Cloudflare IP ranges on port 443.
- Content Security Policy (CSP) and HSTS implemented.
Logging and monitoring
- Logpush configured to export logs to S3 bucket for SIEM integration.
- Real-time visibility into security events and system performance.
- Custom branded error and challenge pages.
Architecture
User, API and bot traffic converge on a single Cloudflare edge plane before reaching the tokenisation platform.
End users Global, real-time
API clients Programmatic
Bot traffic Discovery + abuse
Cloudflare edge
Tokenisation platform Web + UI
Public APIs Cached + rate-limited
SIEM Logpush → S3
Results
After rollout, the platform was hardened against DDoS, bots and credential-stuffing while shedding 20-30% of load time and 30-40% of bandwidth, with full security telemetry exported to SIEM.
Faster load times20-30% reduction via CDN distribution, Polish image compression and HTTP/3 protocol optimisation.
DDoS-resilient platformEnterprise-level DDoS mitigation kept the platform available with zero impact from volumetric attacks.
Automated abuse neutralisedBot management and custom rate limiting blocked credential stuffing and bot-driven API abuse.
Centralised security telemetryLogpush exports security and performance logs to S3 for SIEM ingestion and proactive threat management.
