Web Application Securityin a Digitally Connected World

                                               Nikhil Taneja                          

                  Managing Director- India, SAARC & Middle East,Radware

Global organizations stand on a cyber-security precipice. Emerging technologies such as block chain, artificialintelligence (AI) and Internet of Things (IoT), along with the explosive volume of mobile, Web and cloud appscreates uncharted, highly lucrative pathways to revenue generation, optimized productivity and enhancedbrand value. At the same time, the speed and sophistication inherent in these technological advances exposesapplication vulnerabilities, security risks and skills deficiencies. These compromise sensitivecompany and customer data, devalue the brand and severely impact financial performance.

The conundrum for any organization is how to take the leap towards these new technologies that help breakdown barriers to consumer engagement and deliver substantial economic reward while success fully protecting corporate assets, intellectual property (IP) and personal customer information.

It is important touncover other aspects such as thechallengesthese newtechnologies and rapid-fire application deployments present,ascertainhoworganizationsin different industries identified application-layer and API vulnerabilities, measure the impact that bots have on organizations, how companies combat application-layer attacks (like those listed in the OWASPTop 10) and construct a security roadmap for today and tomorrow.

Also, vital to understand howthe exponential number of security breaches against the application layer (such as the recent Equifax attack)would alter the financial and operational actions these companies would take.

Based on a survey conducted with over 600 chief information security officers(CISOs) and other security leaders across six continents, the following key findings came forth:
•Sixty-eight percent of organizations admit low confidence in information security posture
•Organizations often leave sensitive data under-protected. Forty-five percent report theysuffered a databreach while 52% do not inspect traffic being transferred to and from APIs. Fifty-six percent do not havethe ability to track data once it leaves the company.
•Bot traffic represents more than half (52%) the amount of Internet traffic, exceeding 75% of the total trafficamong some organizations. Forty-nine percent of all bot traffic is bad bots, yet 33% of organizationscannot distinguish between good and bad bots.
•API security is often overlooked. While 60% both share and consume data via APIs, including personallyidentifiable information, usernames/passwords, payment details, medical records, etc., 52% don’t inspectthe data that is being transferred via APIs and 51% don’t perform any security audits or analyze APIvulnerabilities prior to integration.
•Application-layer DDoS is a greater fear than network-level DDoS assaults. Only 33% feel confident theycan mitigate application-layer attacks compared to 50% that feel confident they can protect againstnetwork-layer DDoS attacks.
•Seven out of ten businesses (72%) are not fully aware of the frequent change made to in-houseapplications and APIs within their organizations’ software development environment.
•Forty percent of respondents claim their organization updates applications at least once per week, posinga great challenge for organizations.
•Everyone wants the speed and agility that continuous delivery provides but few feel they can achieveit securely. Half (49%) currently use the continuous delivery of application services and another 21%plan to adopt it within the next 12-24 months. However, 62% reckon it increases the attack surface andapproximately half say that they don’t integrate security into their continuous delivery process.
•Less than a year prior to the due date (May 2018) for General Data Protection Regulations (GDPR) compliance, 68% of organizations are not confident they will be ready to meet these requirements in time
#1 Conundrum: The Confidence Crisis:Protecting ApplicationsAgainst Data Theftand Bot Attacks
As the rate and number of new technologiesmaterialize at an accelerated pace, many securityprofessionals face the unprecedented challenge ofmitigating a wide swath of threats and attacks thatoften are byproducts of the evolving IT landscape.Existing security strategies, plans and measuresmay not measure up to quickly developed malware,floods and other threats. The result is a “crisis ofconfidence” that can overwhelm skills, depletebudget and resources, chip away at brand equityand fracture customer/partner relationships.

Take the recent Equifax breach, which exposedover 145 million individuals and their personal information because of a Web application vulnerability. While there may have been governance and accountability plans in place, there may havebeen other actions, such as a WebApplicationFirewall (WAF), which could have mitigated such a massive attack had it been updated properly againstknown vulnerabilities. A simple question may have been: did the company have the confidence theycould protect against a probability of attack or wasfalse confidence in the “impossibility” of such anattack their strategic approach.

The growing prevalence of attacksis a known fact;thus, the more alarming findingis theuncertainty within these companies thatthey could even detect, prevent or containthese attacks, especially when it comes toemerging threats such as Layer 7 DDoSattacks. Research shows that 64% of financialservices institutions, 62% of healthcareorganizations and 58% of retailers acknowledgethe difficulty in mitigating Layer 7 DDoS attacks.

Bot Attacks
Automated attack programs, such as ‘bad’ bots, are the main force behind the majority of the attacklandscape today. In fact, bots conduct more than half of all Internet traffic flow. For some organizations, botsrepresent more than 75% of their total traffic. This is a significant finding
considering only one in three (33%)organizations cannot distinguish between good bots and bad ones. Good bots serve critical functions, suchas price aggregators to customer service chatbots and search engine spiders. However, for every good bot inthe world, there is a bad bot wreaking havoc.Bots make traditional attack vectors more effective, faster and larger than anything humans can accomplishon their own.

#2 Conundrum: ContinuousDelivery Security Challenge
Organizations are looking for ways to optimize the deployment of application services. Many try to fullyautomate the cycle of application development, QA, testing, modifying and deploying in staging, andthe production environment in what is known as continuous delivery. A successful continuous deliveryimplementation can yield a competitive edge and save operational expenses. For some of the more dynamicapplication services, the fast pace is critical as they are required to deploy multiple versions into productionper day. The challenge, on the other hand, is to ensure accurate application security throughout the process,as almost two-thirds (62%) believe it increases the attack surface.continuous delivery is high priority for many organizations with half ofrespondents currently using this approach and another 20% planning to do so within the next two years.

Research indicated that security executives and other experts understand the impact continuous deliveryis having on their organizations. While sixty-two percent believe continuous delivery increases the attack surface, risks and vulnerabilities, only 25% are confident that security is integrated with continuous delivery ofin-house, Web or cloud.

#3 Conundrum: GDPR Preparedness Effect
Organizations around the world that do business in or with the European Union (EU) will soonneed to meetstricter data privacy laws with the GDPR taking effect in May, 2018. Any organization that offers goods orservices to EU residents, monitors personal behavior or processes or handles personal data of EU residentswill be impacted by this law. Those who do abide by the regulation will be subject to hefty fines. This is aparticular challenge for large multi-national corporations that do business in the EU as well as companies thatmay be headquartered there.

It is advised that whatever WAF solution an organization is evaluating, it covers critical security solution fundamentals – complete OWASP Top 10 vulnerabilities, effective API security, HTTP DDoS mitigation.By evaluating existing security processes, systems and security tools, and implementing application securitysolutions and practices that augment and enhance these capabilities, organizations will build the foundationfor an application-secure infrastructure