Webscale webinar about Web Application Firewall
•Download as PPTX, PDF•
1 like•146 views
Hackers are smart. Time to be smarter. Webscale's webinar gives you more information about Unmanaged web applications: the vulnerabilities you don’t know about and the risks they pose to your business. There is also an overview of recent cyber threats and the latest trends in cyber security. You can also find 5 simple steps to take back control of your web applications.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Webscale webinar about Web Application Firewall
Similar to Webscale webinar about Web Application Firewall (20)
Recently uploaded
Recently uploaded (20)
Webscale webinar about Web Application Firewall
- 1. WEBSCALE WEBINAR Hackers are smart. Time to be smarter. Jay Smith| Founder & CTO, Webscale Sonal Puri | CEO, Webscale Your hosts: 10th October, 2017
- 2. • EVOLUTION OF WEB APPLICATIONS • INTRODUCTION TO WEB APPLICATION FIREWALL (WAF) • WHY WAF • WEB APPLICATION THREATS • A BRIEF INTRODUCTION TO WEBSCALE • WEBSCALE CLOUD SECURE • WEBSCALE UNIFIED PORTAL AGENDA
- 3. EVOLUTION OF WEB APPLICATIONS
- 4. 1997 1999 2001 2003 CDN 1.0 | CACHING EDGE DELIVERY ROUTE OPTIMIZATION PEERING POINTS APP SERVER INTERNET CLOUD • Peering Points • Server Overload • Bandwidth Cost PROBLEMS • Performance BUSINESS REQUIREMENTS WEB 1.0 | STATIC
- 5. 2005 2007 2009 2011 MOBILE OPTIMIZATION EDGE INTELLIGENCE FRONT END OPTIMIZATION • Connectivity • Edge to Device • Increasing Dynamic Content PROBLEMS • Performance • Availability BUSINESS REQUIREMENTS CACHE WEB 2.0 | DYNAMIC DYNAMIC CONTENT RICH MEDIA
- 6. 2013 2015 2017 2019 COMMODITY CDN UTILITY CLOUD INFINITELY SCALEABLE APPS BIG DATA HTTP/2 • Application & Infrastructure • Dynamic Content Problems • Performance • Availability • Security Business Requirements WEB 3.0 | INTERACTIVE
- 7. WEB APPLICATION FIREWALL (WAF)
- 8. User 1 | SAFE User 2 | SAFE User 3 | UNSAFE Web Application Firewall Identifies and blocks malicious web traffic and requests User 1 User 2 x Web Application Server WHAT IS A WAF ?
- 9. Internet Web Application Firewall Network Firewall Non HTTP Attacks HTTP Attacks NETWORK FIREWALL VS. WAF NETWORK FIREWALL WEB APPLICATION FIREWALL • Layer 3 (Network) & 4 (Transport) • Authorization decisions based on source & destination IP addresses, protocol type & port numbers • Susceptible to exploits like buffer overruns, IP spoofing, ICMP tunneling • Layer 7 (Application Layer) • Scans transmitted data for malicious content • Acts as reverse proxy to application servers • Less susceptible to attacks
- 10. WHY WAF ?
- 11. 75%Percentage of all cyber attacks targeting web applications - Gartner 4BNumber of records leaked in 2016 - IBM 32%Growth in number of hacked sites in 2016 - Google After Joomla, WordPress accounted for 10% and Magento with 7% of all web application attacks. WEB APPLICATION ATTACKS 70%Retailers take days or longer to investigate the source of attack - RSA 25%Percentage of all web application attacks targeting Joomla- AlertLogic 88MAttacks ecommerce industry experienced in Q2’17 - ThreatMatrix
- 12. Application Security • Application Vulnerabilities • OWASP Top 10 Protection • DDoS Mitigation Proactive Defense • IP Black/White Listing • Geo Blocking Application Performance • SSL Offload • Caching Compliance • Logging and reporting • Visibility WHY WAF ?
- 14. Overwhelming a site with requests for information, severely slowing the operation of a website or bringing it down entirely. Inserting JavaScript in the pages of a trusted site to completely alter its contents. Jumping into the session of another user, reading information as it passes between the user and the server. Allows attackers to trick users into performing actions without their knowledge. Injecting malicious SQL statements into the site to trick the interpreter into executing unintended commands or accessing data without proper authorization. SQL INJECTION DENIAL OF SERVICE CROSS SITE SCRIPTING SESSION HIJACKING CROSS-SITE REQUEST FORGERY (CSRF) COMMON WEB APPLICATION THREATS
- 15. EQUIFAX DATA BREACH One of the most significant data breaches in recent history with social security numbers of 143 million Americans potentially compromised. RECENT CYBER ATTACKS WANNACRY RANSOMWARE Largest online extortion attack ever recorded that crippled government and infrastructure in more than 150 countries. NOTPETYA MALWARE Like WannaCry ransomware, NotPetya malware also exploited EternalBlue vulnerability in Microsoft Windows that caused serious disruption at large firms in Europe and the US. HBO DATA HACK Hackers obtained all of HBO’s social media logins, GIPHY credentials, and leaked scripts and episodes of their most popular series – Game of Thrones.
- 16. • Cyber attacks continue to grow in size, complexity, and frequency • Mobile & IoT are emerging to be the new cybercrime targets • Ransomware and other advanced threats are target retailers • Attacks are evolving from isolated attacks on large organizations to networked attacks targeting multiple key infrastructures and organizations • Increasing number of attacks appearing from emerging and growth economies • Businesses in the US continue to be the target of attacks from cybercriminals across the globe EMERGING TRENDS IN CYBER SECURITY 16
- 17. TOP ECOMMERCE SEGMENTS AFFECTED BY FRAUD 17 19% 15% 13% 10% 4% 4% 2% Money Transfer Travel Business Services Electronics Fashion Entertainment Casino & Gambling Source: RSA 2017 Global Fraud and Cybercrime Report
- 18. FIVE STEPS TO STRONGER PROTECTION Implement a robust security solution Continuous assessment for vulnerabilities Conduct regular audits and trainings Incident response and disaster recovery plan Enable role based access controls
- 20. A BRIEF HISTORY NPS Score 71 In just 4 years, Webscale has migrated more than 600 web applications and ecommerce storefronts to the cloud, delivering performance, availability, security and control to more than 100 customers across 7 countries. Delivering up to 75% reductions in costs while providing up to 50% improvement in site performance, Webscale is the only company focused on delivering a true multi-cloud platform, for complete web application delivery and control to mid-market businesses transacting online. INTRODUCTION TO WEBSCALE
- 22. WEBSCALE CLOUD SECURE The application-aware WAF
- 23. • Be Application Aware • Control the Application • Provide fool-proof security without impacting performance • Provide Custom Security Policies • Support Multi-Cloud Requirements • Provide Real Time Analytics • Be Protected from known and unknown threats including Bots • Be Multi-tenant NOT ALL WAFS ARE CREATED EQUAL A robust WAF must:
- 24. SAMPLE VERTICAL: E-COMMERCE THE IMPORTANCE OF APPLICATION AWARENESS 600+ storefronts deployed across these and other platforms 42% of web application attacks Real-time learning across large customer base creates deep understanding of known exploits and fixes ACTIVE MONITORING OF BACKEND BLACKLIST WHITELIST BLOCK SHIELD MODE ROBUST PROTECTION OF WEB APPLICATIONS THROUGH AUTOMATIC UPDATES AND SIMPLE DIY TOOLS
- 25. CLOUD SECURE The application-aware firewall
- 26. APPLICATION AWARE DECENTRALIZED CONTROL AND DATA PLANES RATE LIMITING VIRTUAL PATCHING CUSTOM SECURITY RULES BLACKLISTING WHITELISTING KEY FEATURES
- 27. WEBSCALE ENTERPRISE CLOUD SECURITY More than just an application-aware firewall
- 28. BENEFITS MITIGATE DDoS ATTACKS PCI-DSS COMPLIANT REAL-TIME ACCESS CONTROL PROTECT AGAINST OWASP TOP 10 TRUE CLOUD SAAS BEST-IN-CLASS HTTPS SUPPORT
- 29. CHALLENGES • Reduce DDoS attacks to eliminate downtime and outages • Manage scale out capacity and associated costs PROCESS RESULTSSOLUTION RESULTS Deployed Webscale Pro • Comprehensive DDoS protection • PCI-DSS compliant • Predictive auto-scaling • Disaster Recovery • Uptime increased 100% • Cost of IT Infrastructure management reduced by 60% • Protection against external web threats The amount of support we receive from Webscale is unprecedented. Their proactive support team has an answer for me before I even call, because they are constantly monitoring our systems. INDUSTRY Online Stores APPLICATION E-Commerce MONTHLY VISITS 440,000 RESCUED FROM Peer1 CASE STUDY: EVENT NETWORK A leading operator of over 100 online gift shops for cultural centers.
- 30. • Integration, deployment, configuration and management of web application through unified portal • Apply custom rulesets • Monitor access control • Traffic visualization • Real-time application status UNIFIED PORTAL
- 31. • Web controls - Manage how the web application responds to Web Requests (traffic) • Each control consists of a set of conditions that when true will cause the ADC (data plane) to execute whatever actions are associated with the control • EXAMPLE: Redirects, denying requests, routing to alternate servers or clusters • Cloud controls - Detect Conditions within the Application and its Infrastructure • Webscale applies an automated control to alter the Application Infrastructure in response to the detected condition. • EXAMPLE: Scale out when increase in response times or shortfall in CPU or network capacity is detected WEBSCALE WEB AND CLOUD CONTROLS THE FASTEST, EASIEST WAY TO ALIGN SECURITY AND PERFORMANCE
- 33. MAIN PAGE AND APPLICATION VIEW
- 35. ADD NEW HOSTNAMES IN SECONDS
- 36. EASILY ADD TRAFFIC RELATED CONTROLS
- 37. THANK YOU
Editor's Notes
- By 2020 all apps would be HTTP based
- Jay- 7 mins
- RANSOMWARE Malicious software that locks down systems, preventing access until the hacker’s monetary demands are met. PHISHING Delivering malware or tricking the user into divulging sensitive information.
- Equifax: According to Equifax, hackers exploited a security vulnerability in a U.S.-based application to gain access to consumers’ personal files. The company has not yet said which application or which vulnerability was the source of the unauthorized breach. More on: http://clark.com/personal-finance-credit/equifax-breach-how-to-protect-yourself-from-whats-coming-next/ WannaCry: WannaCry is a ransomware virus that holds computers hostage until the user meets the demands. The WannaCry software infected computers operating on Microsoft and displayed messages demanding users to pay $300 in bitcoin — type of digital currency widely used online. The required payment would typically double to $600 if the first ransom wasn't paid within days and, after a week failed action, all files on the infected computer would be destroyed. The malware paralyzed computers in factories, banks, government agencies and transport systems, hitting 200,000 victims in more than 150 countries. NotPetya: The ransomware takes over computers and demands $300, paid in Bitcoin. The malicious software spreads rapidly across an organization once a computer is infected using the EternalBlue vulnerability in Microsoft Windows (Microsoft has released a patch, but not everyone will have installed it) or through two Windows administrative tools. The malware tries one option and if it doesn’t work, it tries the next one. When a computer is infected, the ransomware encrypts important documents and files and then demands a ransom, typically in Bitcoin, for a digital key needed to unlock the files. If victims don’t have a recent back-up of the files they must either pay the ransom or face losing all of their files. More on : https://www.theguardian.com/technology/2017/jun/27/petya-ransomware-cyber-attack-who-what-why-how
- Multi-cloud: Not every WAF provider is cloud, hardware or CDN agnostic, and chances are, your applications live across two or more of these platforms today. Choosing a provider that limits or restricts your current application strategy with their solution can leave you exposed and bring upon numerous manageability issues when it comes to your application security. Decrypt and inspect SSL and control SSH: Should be able to recognize and decrypt SSL and SSH on any port, inbound or outbound; have policy control over decryption; and offer the necessary hardware and software elements to perform SSL decryption simultaneously across tens of thousands of SSL connections with predictable performance. Provide protection against known and unknown threats: Must first identify the application, determine the functions that should be permitted or blocked, and protect the organization from known and unknown threats, exploits, viruses/malware or spyware. This must be done automatically with near-real time updates to protect from newly discovered threats globally.
- Multi-cloud: Not every WAF provider is cloud, hardware or CDN agnostic, and chances are, your applications live across two or more of these platforms today. Choosing a provider that limits or restricts your current application strategy with their solution can leave you exposed and bring upon numerous manageability issues when it comes to your application security. Decrypt and inspect SSL and control SSH: Should be able to recognize and decrypt SSL and SSH on any port, inbound or outbound; have policy control over decryption; and offer the necessary hardware and software elements to perform SSL decryption simultaneously across tens of thousands of SSL connections with predictable performance. Provide protection against known and unknown threats: Must first identify the application, determine the functions that should be permitted or blocked, and protect the organization from known and unknown threats, exploits, viruses/malware or spyware. This must be done automatically with near-real time updates to protect from newly discovered threats globally.
- Multi-cloud: Not every WAF provider is cloud, hardware or CDN agnostic, and chances are, your applications live across two or more of these platforms today. Choosing a provider that limits or restricts your current application strategy with their solution can leave you exposed and bring upon numerous manageability issues when it comes to your application security. Decrypt and inspect SSL and control SSH: Should be able to recognize and decrypt SSL and SSH on any port, inbound or outbound; have policy control over decryption; and offer the necessary hardware and software elements to perform SSL decryption simultaneously across tens of thousands of SSL connections with predictable performance. Provide protection against known and unknown threats: Must first identify the application, determine the functions that should be permitted or blocked, and protect the organization from known and unknown threats, exploits, viruses/malware or spyware. This must be done automatically with near-real time updates to protect from newly discovered threats globally.
- Multi-cloud: Not every WAF provider is cloud, hardware or CDN agnostic, and chances are, your applications live across two or more of these platforms today. Choosing a provider that limits or restricts your current application strategy with their solution can leave you exposed and bring upon numerous manageability issues when it comes to your application security. Decrypt and inspect SSL and control SSH: Should be able to recognize and decrypt SSL and SSH on any port, inbound or outbound; have policy control over decryption; and offer the necessary hardware and software elements to perform SSL decryption simultaneously across tens of thousands of SSL connections with predictable performance. Provide protection against known and unknown threats: Must first identify the application, determine the functions that should be permitted or blocked, and protect the organization from known and unknown threats, exploits, viruses/malware or spyware. This must be done automatically with near-real time updates to protect from newly discovered threats globally.