UEFA's hosting partnership with Interoute is supporting the football governing body's move into the cloud and helping to protect against the growing cyber attack threat faced from hactivist groups.
UEFA is a non-profit organisation tasked with delivering major football events throughout Europe, from the yearly, season-long Champions League to the European Championships, an event which occurs every four years and involves a massive spike in demand on UEFA's systems.
The nature of the European Championship event, dwarfed only by the World Cup in terms of size, means that IT infrastructure and operations need to be scaled up considerably for periods of time. This involved drafting in large numbers of ICT staff from suppliers and partners to meet high SLAs and to ensure that services such as its website and broadcasting capabilities have 100 percent availability.
“Unlike the Olympics, if we fail it is not seen as the country failing, it is UEFA. This means we are very keen to succeed,” said UEFA's head of ICT, Daniel Marion, at the Cloud World Forum in London.
UEFA hosts a number of events throughout the year, including under 21s tournaments and club matches, requiring a number of enterprise applications to support its operations. As well as finance and other enterprise systems, the most significant IT requirements are the hosting of the UEFA.com website, and a bespoke CRM platform.
The Football Administration and Management Environment (FAME) platform is an in-house developed .NET CRM system that is used to provide a range of services to the various stakeholders that interact with UEFA. This could mean national Football Associations, sponsors or media, and the system also keeps detailed data records on every player and referee in each league operating under UEFA's jurisdiction.
“The idea was to create an application that can be used by all of our stakeholders, the clubs, officials and so forth, our media partners and sponsors," Marion said. "Everyone will go there to do anything they have to do with us – such as advertising, transport or ordering studios and cameras for broadcasting.”
Hosting services and move to the cloud
For the past two years almost all of UEFA's IT infrastructure has been housed on virtualised servers in a data centre run by Interoute as part of a three-year managed hosting agreement. The data centres located in Geneva and Amsterdam also provide disaster recovery for the range of applications run by UEFA, meaning that, with the highly outsourced IT operations (Interoute manages 90 percent of its systems) the organisation has little infrastructure of its own.
In addition UEFA has begun to move some of its applications to a private cloud environment using Interoute's Virtual Data Centre (VDC) - an infrastructure as a service (Iaas) platform which allows scaling of compute capacity on demand.
According to Marion, as the demands on UEFA IT systems grow for a variety of reasons, such as increased website use via mobile devices or supporting the introduction of wifi and NFC connected stadiums, the intention for UEFA is to eventually bring all of its production environment into the cloud.
“The new technology such as NFC and wifi gives us lots of opportunity to engage with the fans, and is a game changer. But it is also a challenge. Having these new technologies in stadiums means we need new capabilities in the stadiums to deliver,” he said.
So far, the organisation has begun using the cloud environment for its testing and development, and has also moved its Microsoft Exchange systems into the VDC platform.
“We are trialling Exchange in the cloud in a dedicated platform, but we are looking at what makes more sense for us – sourcing it directly from Microsoft or having something more bespoke.”
He added: “Our next opportunity will be public cloud. From a innovation perspective we are looking at how we can leverage public cloud from a scalability perspective, but also from a cost perspective.”
This could potentially mean developing a new version of its FAME platform and placing it in the cloud to access as a SaaS platform, he said.
Cyber attack threat
One of the other main functions for Interoute's hosting environment is to provide security support for UEFA, with Marion indicating that cyber attacks are becoming an increasing problem for the organisation.
As in many industries, UEFA is increasingly the target for cyber attacks, and there has been a sharp rise in the number of cyber attacks in the past eighteen months, he said.
The majority of attacks come during a large event like the European Championships, with an indication that in certain instances originate from fans taking aim at UEFA's website in retaliation against contentious footballing decisions.
“It has become more of an issue over the last eighteen months,” Marion told ComputerworldUK. “Hactivism has been more active in the past two or three years. It has been seen in other areas and now sport. The Olympics went through the exact same thing. In 2008 we had zero and in the last Euros we had every day attacks.
“When we take disciplinary decisions or sanctions, the fans usually take it as a bad decision. Therefore in the past they could protest only, now they can go online and do a lot of things. This is the big change because now online with the Anonymous-type attacks you can start to create massive attacks even with a crowd of two hundred people.”
In response to the increased problem of cyber attacks, UEFA began bolstering its defences a year and a half ago.
“We have invested in security and we are expecting that to increase. Security is definitely one of the new pillars we have to take care of and invest in,” said Marion.
“Eighteen months ago we saw this was happening and we raised the flag, and we invested heavily in security. This means DDOS protection, IPS, log-in analysis and those types of things. Also education of staff - security is an everyday action in terms of protecting the data.”
He said that Interoute's hosted environment is also helping stem the growing tide of attacks.
“The fact that we have this highly virtualised environment helps us to protect the assets we have by being able to shut down one data centre and putting it into the other, and direct the attack to where we want it to go.”