NSDC – WorldSkills Shanghai 2026 | AWS WAF Monitoring
Continuous Security Monitoring for India’s Largest-Ever WorldSkills Team
13 Days
Continuous Monitoring
25
12-Hour Review Cycles
1 Billion+
Requests Handled
1 Million+
Requests Blocked
Client Overview
The National Skill Development Corporation (NSDC) supports India’s skilling initiatives and relies on digital platforms to reach learners, training partners and the public. During WorldSkills Shanghai 2026, AppSquadz provided enhanced AWS WAF monitoring to maintain visibility into web traffic and security activity throughout the event.
Client
National Skill Development Corporation (NSDC)
Industry
Government & Public Sector
Requirement
Provide enhanced AWS WAF monitoring across multiple AWS environments, with regular reporting on web traffic, blocked requests, and unusual security activity throughout the WorldSkills Shanghai 2026 event.
Have a similar requirement?
Get in touch with us →
Executive Summary
AppSquadz provided enhanced AWS WAF monitoring for the National Skill Development Corporation (NSDC) from 17 to 29 September 2026, covering the run-up to and duration of WorldSkills Shanghai 2026. Across 25 twelve-hour review windows, the Security Operations team tracked web traffic, reviewed unusual activity, and shared written updates with NSDC after each window. The monitoring identified automated scanning, exploit-pattern requests, and other unwanted traffic, which were blocked at the WAF in the reviewed samples. No confirmed successful compromise or security incident was identified from the available WAF data.
Why this event mattered
WorldSkills is often called the “Olympics of Skills”. The 48th WorldSkills Competition, held in Shanghai from 22 to 27 September 2026, brought together more than 1,400 young skilled professionals from over 70 countries and regions, competing across 64 skills.
For India, the stakes were high. Team Skill India, the country’s largest-ever contingent, sent 70 competitors into 63 of those skills, including 11 India had never entered before, such as Unmanned Aerial Systems and Software Testing. It came on the back of steady progress: India has climbed from 29th place in 2015 to 13th at WorldSkills Lyon 2024.
The team’s participation reflected the Skill India Mission and the vision of a skilled Viksit Bharat. As NSDC’s digital platforms serve learners, training partners and the public, increased attention can bring both genuine visitors and unwanted traffic.
That is why NSDC asked AppSquadz to keep a close watch.Overview
NSDC asked AppSquadz to provide enhanced monitoring of its AWS Web Application Firewalls (WAFs) for the whole event window. Over 13 days, our Security Operations team reviewed WAF activity in 12-hour windows and sent NSDC a clear written update after each one.
- Normal traffic kept flowing while unwanted traffic was filtered at the edge
- Block rates stayed low, so the rules acted on a small, targeted share of requests.
- No confirmed security incident was identified from the available WAF data.
In plain terms: a web application firewall (WAF) sits in front of a website and filters each incoming request, allowing genuine visitors through and blocking suspicious ones. A Web ACL is the set of rules that tells the WAF what to allow, block, or challenge.
The Challenge
NSDC needed confidence that its web platforms stayed protected and available while the world was watching. Four needs stood out:
- Visibility: The team needed to see what was reaching its web applications at any hour, not only after a problem appeared.
- Complexity: Protection was spread across multiple layers and separate AWS environments, and needed to be seen as one picture.
- Global traffic: With an event held abroad, traffic came from many countries. Genuine users had to be separated from unwanted traffic.
- Clear communication: NSDC’s team needed short, plain updates they could act on, not raw technical data.
Our Approach
AppSquadz set up a structured monitoring routine that ran for the full period, from 17 to 29 September 2026.
- Defined the scope: We agreed with NSDC exactly which protections and environments were in scope.
- Monitored in 12-hour windows: Each day was split into a day window and a night window, from the first day window on 17 September to the last on 29 September. That made 25 windows with no gaps.
- Combined two data sources: Amazon CloudWatch WAF metrics gave the numbers of allowed, blocked, counted and challenged requests. AWS WAF sampled requests showed source countries, requested paths and the rules that were triggered.
- Watched for early warning signs: Our monitoring dashboard flagged sudden rises in blocked requests, newly seen source countries and newly triggered rules. Every flag was reviewed by an engineer.
- Reported every 12 hours: After each window, NSDC received an email summary in plain language, with a detailed analysis report attached.
- Reported with care: A blocked request is not proof of an attack, and an allowed request is not proof of safety. Our reports stated clearly what the data showed and what it did not.
Result
Across the monitoring period, the WAFs filtered unwanted traffic while normal traffic continued to flow. Block rates stayed low, which shows that most traffic was normal and that the rules acted on a small, targeted share.
Requests blocked and share of requests blocked for three representative Web ACLs, 17 to 29 September 2026. Figures are rounded; request counts are per Web ACL and may overlap where protected paths are shared.
What the WAF blocked
Samples taken from each window showed the kinds of activity below. In the reviewed samples, all of it was blocked at the WAF.
| Type of activity | What the WAF blocked |
|---|---|
| Automated scanning | Repeated probing of common login, admin, configuration and backup paths. |
| Known web attack patterns | File inclusion and path traversal attempts. |
| Application exploit patterns | Requests carrying signatures linked to known web-framework vulnerabilities. |
| Router exploit payloads | Command-injection strings aimed at router firmware, not at the client’s applications. |
| High-volume request bursts | Short bursts of rapid automated requests aimed at application endpoints. |
| Poor-reputation sources | Traffic from hosting providers and IP addresses with a known bad reputation. |
| Unusual source locations | Requests from regions with no legitimate reason to reach these platforms. |
Early detection of unusual behaviour
During the monitoring period, the dashboard flagged short bursts of unusually high blocked-request activity. Each one was contained by the WAF, reviewed by an engineer, and reported to NSDC in the next 12-hour update. Because the team was watching round the clock, unusual activity was spotted and explained within hours rather than discovered later.
Value Delivered
- Continuous visibility: Web traffic and security activity were tracked for the full event.
- Plain-language updates: A report every 12 hours meant NSDC’s team always knew the current position.
- Early warning: Spike, new-country and new-rule flags surfaced unusual activity quickly.
- Honest reporting: Findings were graded by risk and clearly separated from confirmed incidents.
- Practical next steps: The final report included prioritised recommendations to strengthen protection further.
Conclusion
The monitoring showed recurring automated scanning, traffic from unusual locations and poor-reputation sources, short request bursts and exploit-pattern requests. In the reviewed samples, these requests were stopped at the WAF. No confirmed successful compromise or security incident was identified from the available WAF data.
As India’s young professionals competed on the world stage, the platforms that support India’s skilling mission stayed under continuous, expert watch. The same approach, built on a clear scope, regular review windows and plain reporting, can be applied to any organisation that runs public web applications on AWS.
Vishal Deep Prajapati
Chief Technology Officer, DevOps
Project Delivery & Cloud Security Leadership
Vishal Deep Prajapati, CTO at AppSquadz, brings expertise in AWS infrastructure, DevOps, and cloud security. His technical leadership supports the delivery of critical cloud security engagements, including AppSquadz’s work with the National Skill Development Corporation (NSDC) during WorldSkills Shanghai 2026. The engagement involved 13 days of continuous AWS WAF monitoring, 25 twelve-hour review windows, and regular security activity reports to help NSDC maintain visibility into web traffic and potential threats throughout the event.
Security • DevOps & Infrastructure Operations • AWS WAF Monitoring • Security Operations • Threat Monitoring
Running public-facing applications on AWS?
Talk to the AppSquadz Cloud Security team about monitoring built for the moments that matter.
Get in Touch with Our Experts
Whether you have a project in mind, a query, or simply want to explore how we can collaborate, we’re here to help.