Thinking Like An Attacker!

Every business integrates applications to their business partners and consumers. Imagine, what if an application owner says, “We trust our partners and consumers and know that they will not engage in any malicious activity which exploits the application” or “a security compromise cannot happen on the company’s watch”. If these statements sound familiar, then the next step for an application owner would be to say, “I thought my system was secure enough to protect against the attack”. One of many areas wherein you need to think like an attacker is right here – it’s important to remember that applications are business enablers, the business earns money, money lures attackers, and subsequently attackers follow the money.

In the age of digital economy, it is more important than ever before to protect the applications against any susceptibilities, abuse of customer accounts, or attacks against business operations. Any unauthorized access to applications can consequently lead to cyber espionage where attackers can sabotage the entire application operations.

According to Forrester’s 2020 State of Application Security Report, “Application weaknesses and software vulnerabilities continue to be the most common external attack method”. With evolving new architectures of applications, the attack surface expands, and it is believed that attackers adapt quickly to compromise applications leading to threats and breaches. Therefore, it is imperative to push security early on in software development to provide defense and support innovation. However, the adoption of security in the onset stages of SDLC is slower or focused on the test phase. It is critical to protect these applications post-deployment and to focus on security than just testing.

Another viewpoint to consider is that organizations adopt automation to improve the efficiency of the applications – from search engines to chatbots – to enhance user experience, but attackers adapt in no time by scaling malicious bots, bypassing security, and compromising digital assets. What is vital to note here is bot attacks are no more just scripts targeting the website to retrieve data or perform an action. In present day, attacks are getting more sophisticated wherein bots are deployed to carry out organized attacks and are also constantly retooled to evade any detection.

One of the common concerns to consider while interfacing with the application is the user and its credentials. Credential theft is considered as one of the key factors in compromising any application. Any user with a compromised device is often unaware that it is infected with malware and trying to take control of their account. According to research by Digital Shadows, 15 billion usernames and passwords are up for sale on the dark web. So, what does this mean? The answer is that your passwords are not safe anymore and attackers can inject those credentials to gain access and take over the accounts.

After understanding the need to protect data, information, and passwords, let’s also touch upon protection against some of the most common attacks like cross-site scripting, SQL injection, path traversal, etc. which may not be enough to protect modern applications. Here, the usage of multi-layered protection is needed to secure an already deployed application independent of the underlying application infrastructure. Protecting applications from critical threats such as OWASP Top 10 or emerging exploits requires comprehensive security. To briefly explain, application security is multi-faceted and utilizes unique components, each serving a different purpose to protect and secure the applications. Each layer focuses on protecting an area that can be exploited by attackers. Having these layers work together reduces the overall risk on the applications exposed to the internet from any kind of cyber-attack or data breach.

At Help AG, we believe most organizations are moving towards implementing multi-cloud strategies for web applications. This shift from traditional on-prem applications to a hybrid or multi-cloud modern applications will increase the need for the security of applications distributed across different platforms. Gartner defined Web Application and API Protection (WAAP) as the evolution of the web application firewall market (WAF), expanding WAF capabilities to four core features: WAF, DDoS protection, bot management, and API protection, therefore, having a multi-layered approach in protecting the application should include (but not limited to):

• DDoS Protection – Layer 3-7 DDoS protection includes prevention of any type of DDoS attack of any size which prevents access and availability of the application
• Bot Protection – A predominant feature required to identify bot behavior and protection against bot traffic
• Attack Intelligence – Providing contextual information with actionable intelligence for a specific attack
• Web Application Firewall – A solution to patch and protect against any application and API threats across a distributed environment
• API Security – Identify and mitigate API threats with Zero Trust implementations for legacy and modern applications
• Account Takeover Protection – Prevents testing of stolen credentials on applications to avoid account takeover

15Bn usernames and passwords are up for sale on the dark web(Source: Digital Shadows)

We at Help AG, inevitably, are evolving landscapes for application security and trying to balance the security and usability of applications. In order to provide protection against application exploits, unwanted bots, unauthorized access, and other automated attacks, we have built the right solutions and services that provide adaptive security and defense against the following wide areas:

• OWASP Top 10 threats and code-level vulnerabilities
• BOTs
• Application Fraud
• User Credentials
• APIs
• Unauthorized Access

Next time, you encounter any incident of application compromise or credential theft, don’t ignore it! When you are ready to take your application security to the next level, we have the team of experts to guide you to the right solutions and assist in your journey of changing from traditional application security to modern and agile application security.

At the end of the day, our objective and goals are simple: Security and Availability!