No matter what your current level of cybersecurity knowledge is, these slides created by EMA Research and A10 Networks will provide valuable insights into the latest trends and empower you with the best practices in cloud and web application security. Download to learn more about: - The top threats that pose a risk to your organization and how to mitigate them - The difference between buzz and hype in today’s security approaches, and how this can be used to help your organization - A discussion of Zero Trust, web application security, DDoS protection, encryption, and more for the hybrid cloud world

1. Navigating Todays Threat Landscape
Christopher M. Steffen, CISSP, CISA. - Vice President – Research, EMA
Paul Nicholson - Sr. Director of Product Marketing, A10
Sept. 2023
Discussing Hype vs. Reality

2. | @ema_research 2
Watch the On-Demand Webinar
• Navigating Today's Threat Landscape: Discussing Hype vs. Reality On-
Demand Webinar:
https://info.enterprisemanagement.com/navigating-todays-threat-
landscape-webinar-ss
• Check out upcoming webinars from EMA here:
https://www.enterprisemanagement.com/freeResearch
© 2023 Enterprise Management Associates, Inc.

3. | @ema_research
| @ema_research
Featured Speakers
Chris brings over 20 years of industry experience as a noted
information security executive, researcher, and presenter, focusing
on IT management/leadership, cloud security, and regulatory
compliance. He holds several technical certifications, including
Certified Information Systems Security Professional (CISSP) and
Certified Information Systems Auditor (CISA), and was awarded
the Microsoft Most Valuable Professional Award five times for
virtualization and cloud and data center management (CDM). He
holds a Bachelor of Arts (Summa Cum Laude) from Metropolitan
State College of Denver.
Paul brings 25 years of experience working with Internet and
security companies in the U.S. and U.K. In his current position, Paul
is responsible for global product marketing, technical marketing,
and analyst relations at San Jose, Calif.-based security, cloud and
application services leader A10 Networks. Prior to A10 Networks,
Nicholson held various technical and management positions at
Intel, Pandesic (the Internet company from Intel and SAP), Secure
Computing, and various security start-ups.
© 2023 Enterprise Management Associates, Inc. 3
Christopher M. Steffen
VP of Research
Information Security, Risk and Compliance Management
Enterprise Management Associates
| @ema_research
Paul Nicholson
Sr. Director of Product Marketing
A10 Networks

4. • Security Trends
• Zero Trust
• Hybrid Cloud and Web Workloads
• DDoS Protection
• Reflectors and Bots
• Artificial Intelligence and Security
Agenda

5. | @ema_research
Trends in Cybersecurity
5
GDPR, CCPA, and PIPL
regulations
Enterprises trying to get a
handle on their entire
data estate
5 Trends to Watch in Cybersecurity
| @ema_research
More than just PCI –
each industry has their
own standard
Vendor due diligence is
stepping up from supply
chain attacks
Cloud migrations
continue to increase, in
part due to pandemic
Cloud security adds an
additional layer of
complexity to security
Enterprises that fail at on-
premises security will
likely fail at cloud
security as well
Extremely visible and
destructive, ransoms
calculated by ability
to pay
State-sponsored attacks
on infrastructure will
increase
Recognized by the U.S.
government as a priority
– public/private
partnership to resolve
3.5 million unfilled
cybersecurity positions
Data security and
data privacy
Increasing regulatory
and vendor due
diligence compliance
control
Cloud security and
management tools
Ransomware –
organized and
state-sponsored
Cybersecurity skills gap
© 2023 Enterprise Management Associates, Inc.

6. | @ema_research
Trends in Cybersecurity
6
| @ema_research
© 2023 Enterprise Management Associates, Inc.

7. Implementing Zero Trust Security
• Zero Trust eliminates implicit trust
• Every device, user, network and
application flow is secured
• Removes excessive access privileges and
threat vectors
Source: Pulse
‘Never Trust, Always Verify’

8. | @ema_research
Trends in Cybersecurity - WAF
8
| @ema_research
© 2023 Enterprise Management Associates, Inc.
• Behavioral Analysis and Machine Learning
• Cloud-Native and Serverless Support
• API Security
Year
Broken
Access
Control
Cryptographic
Failures
Injection
Insecure
Design
Security
Misconfiguration
Vulnerable
and
Outdated
Components
Identification
and
Authentication
Failures
Software
and
Data
Integrity
Failures
Security
Logging
and
Monitoring
Failures
Server-Side
Request
Forgery
(SSRF)
2012 1,941 1,133 3,868 888 2,281 1,269 507 222 81 102
2013 2,294 1,262 4,250 1,073 2,655 1,367 588 217 88 122
2014 2,432 1,354 4,527 1,159 2,838 1,472 615 234 101 134
2015 2,587 1,434 4,836 1,246 3,024 1,556 638 249 114 146
2016 2,744 1,516 5,124 1,333 3,214 1,646 662 264 127 158
2017 2,900 1,598 5,412 1,420 3,404 1,736 686 279 139 170
2018 3,056 1,680 5,700 1,507 3,594 1,826 710 294 151 182
2019 3,212 1,762 5,988 1,594 3,784 1,916 734 309 163 194
2020 3,368 1,844 6,276 1,681 3,974 2,006 758 324 175 206
2023 3,524 1,926 6,564 1,768 4,164 2,096 782 339 187 218
2023 3,680 2,008 6,852 1,855 4,354 2,186 806 354 199 230
Estimated number of CVEs released per year for each of
the OWASP Top 10 categories

9. Threshold-based blocking
Events page provides details of an event associated
with IP including
• Country of origin
• Host
• User agents
• Timeline of actions
• When the IP address was identified as
suspicious
• How many requests were received from the
IP before it was flagged
• When the IP was flagged
• How many requests were blocked or logged
• “Sample Request” highlighting a single
request
• and more…
Filter selection to drilldown the events
Granularity in Context

10. A10 Next-Gen WAF on Thunder ADC
App Responses
Fastly Cloud
Engine
Fastly Unified
Management Console
User Requests
Metadata
(Async Push)
Dynamic App
specific detection
Events
Alerts
Metrics
Dashboards
Configuration
Legitimate User Requests
API
Communication
App Server 2
App Server 1
SLB
TLS Offload
AAM
DDoS Protection
Thunder
ADC
Next-Gen WAF
App Responses
Malicious Requests
Blocked
Threat Feeds
NLX and External Sources

11. Mastering Multi-cloud Complexity: Hybrid Control
Harmony
On-Prem
Data Center
Hosted/
Private
ADC ADC ADC ADC ADC
ADC
ADC
#WFH
Users
#Office
Applications &
Systems
More…
Public Clouds
Private Clouds
Other

12. | @ema_research
Trends in Cybersecurity - DDoS
12
| @ema_research
© 2023 Enterprise Management Associates, Inc.
• DDoS attacks used as distractions to hide more sophisticated attacks concurrently such as
extortion and data theft.
• IoT DDoS botnets will emerge and attacks increase from them will continue to be prevalent and
cause significant disruption.
• Continued increases in DDoS attacks from account takeovers
• DDoS as a primary tool of the hacktivist Estimated number of DDoS attacks
that have been publicly reported on in
the news from 2012-2023
577
618
720
887
1,075
1,308
1,563
1,841
2,154
2,509
2,898
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
In 2023 there were 568 complaints
reported to the IC3, with $17,099,378
in total losses related to Denial of
Service attacks from Botnets.

13. Hosting DDoS Scrubbing Service
Results (90 days after deployment)
“The ability to automate and scale the
delivery of differentiated services could
have a major impact on the quality and
economics of DDoS scrubbing services.
A10’s innovations are significant
advancements”
Bart van der Sloot, Managing Director of
Leaseweb Network
• 97,77% of attacks were mitigated through scrubbing
• Increased Net Promoter Score (NPS)
• Overall ~11% reduction in support tickets

14. A10’s Intelligent Automation Protection Cycle
Detection
Traffic
Orchestration
Mitigation
Escalation
Zero-day Pattern
Recognition
DDoS Threat
Intelligence
Auto
Reporting
Auto
Configuration
Incident Report
Generation
Discovery and
Peacetime
Profiling
Before During the Attack After

15. AI/ML Defenses Empower Zero Trust Security
DDoS Defense with Zero-day Automated Protection (ZAP)
Industry’s Fastest Automated Response to DDoS Attacks
Protected
Service
Machine Learning-based
Pattern Detection
Thunder TPS
Normal Random Content
Packet Filtering
DDoS Bot
Reflector
Legitimate User
Distinct Content
Pattern
Spoofed
Request
Distinct Content
Pattern

20. By the Numbers
PP Infoservis-Link –
2M Apple Remote Desktop
(ARD) requests
Secretariat of the Cabinet of
the Ministers of Ukraine –
600,000 Network Time
Protocol (NTP) requests
2M
Requests
34x
Amplification
100x
Less Weapons
ARD amplification value
of >34 times original
request
30,622 ARD weapons
tracked – 10% could
generate 3.2TB, 50% 16TB
ARD, Memcached, and
CLDAP less common -100x
Portmap v 1200 CLDAP
Memcached amplification
51,000x – 2016 GitHub
attack 1.35Tbps

21. | @ema_research
Trends in Cybersecurity - AI
21
| @ema_research
© 2023 Enterprise Management Associates, Inc.
• AI is everywhere in the news lately, but it isn’t really new. Security teams and solutions
have been using it for a LONGGGGGG time…
• AI can be used to augment security – it can be used to parse large quantities of data in
ways that people cannot possibly do.
• Bud guys are using AI – they will likely be the innovators
• Eventually, AI will fight AI...

22. | @ema_research
Closing Thoughts…
22
| @ema_research
© 2023 Enterprise Management Associates, Inc.
• What is keeping the CISO up at night? What is the CEO hearing about
on the 9:00 news?
No one wants to be told by a third party that they are
under attack / being hacked.
• How is AI going to impact me? Information Security? My organization
in general? Are the TERMINATORS coming for me?
• Does the “new” role of the CISO give me power and opportunity to
really accelerate change in my organization?

23. A10 Networks Solutions Portfolio
Converged
Firewall
Thunder CFW
Advanced Load
Balancing
Thunder ADC
+ Next-Gen WAF
IPv4 and IPv6
Gateways
Thunder CGN
Distributed Cloud Management
and Analytics
A10 Harmony Controller SaaS
DDoS
Protection
Thunder TPS
+ aGalaxy
TLS/SSL
Inspection
Thunder SSLi
DDoS Threat
Intelligence
Hypervisor
VMware,
KVM
Public Clouds
Azure, AWS,
OCI, GCP
Container
Docker, Kubernetes
Connector (TKC)
Bare Metal
Software Appliances,
Your Hardware
Hardware
Compact Accelerated
Appliances
Hybrid
Multi-tenant Dell
Appliances

24. CRN Security 100:
The 20 Coolest
Network Security Companies
of 2023: #2
Leading Lights 2023
Finalist: Most Innovative
Cloud Product
or Service — A10 Defend
Interop Best of Show Special Prize:
Security (Targeted Threat/Cyber
Attack Countermeasures)
Category — A10 Defend
Future Security Awards:
DDoS Protection
Vendor of the Year
Cyber Defense Magazine:
DDoS Protection
TLS/SSL Decryption
Leading Lights:
Company of the Year
(public)
San Francisco
Business Times: #9 Largest
Cybersecurity Co.
Thank You
Market Leader: DDoS Protection
for Data Centers, Hybrid Cloud
Application Security, Service
Provider Infrastructure Security
and Zero Trust ETM
(Encrypted Traffic Management)