DDoS Extortion Examination

In terms of the Distributed Denial of Service DDoS landscape, 2020 was almost boring prior to the beginning of August. The excitement from the record peak Gbps and Mpps seen in early summer had worn off, and we weren't seeing...

What's Next in Security

Whenever we talk about what's next for Akamai's security portfolio, we clearly want to look at the challenges that are top of mind for our customers -- both today and tomorrow. And what a year 2020 has shaped up to be in terms of new challenges for CISOs and their security teams. While most of ou...

Akamai and Snyk Partnership Creates a Powerful Combination for In-Browser Script Protection

A web experience begins with the sum of the code you created. But it also includes all the code the user is put in contact with when loading your website. This means the attack surface to monitor for web application software threats is not just your code repositories, but the sum of the assets re...

You Are Here: Giving Your Users the Local Experience They Deserve

Locality matters for most things in life: weather, health care, shopping, product reviews, dinner reservations, social networking, data privacy, news, sports ... the list goes on and on in our ever more connected lives. From direct user interaction on your flagship website or app to IoT device da...

CVE-2022-26143: TP240PhoneHome Reflection/Amplification DDoS Attack Vector

A new reflection/amplification distributed denial of service DDoS vector with a record-breaking potential amplification ratio of 4,294,967,296:1 has been abused by attackers in the wild to launch multiple high-impact DDoS attacks...

Trusting Locations Bites Us Yet Again

Recently, Microsoft announced the discovery of yet another attack being launched by the now infamous Nobelium group, which has been responsible for numerous successful attacks, including the widespread SolarWinds breach in 2020. Thankfully, this latest attempt was not as impactful as those in the...

Credential Stuffing and Account Takeovers -- The Business View

Account takeovers ATOs, in which criminals impersonate legitimate account owners in order to take control of an account, cause tremendous pain for businesses in all industries. This pain may be monetary, such as losses from stolen accounts, but may also include a number of related problems, like...

Sustainability Requires Collaboration: Akamai's Growing Community and Supply Chain Initiatives

picture courtesy of One Tree Planted Akamai is committed to collaboration that inspires worldwide change. We know it's not enough to be environmentally conscious solely in our own business. To make a true impact on climate change, we need to use our unique position as a global corporation to...

Guardicore Insight: Adding Best-in-Class Osquery Visibility to Secure Your Workloads

What if you had a single solution that was able to detect non-compliant and high-risk endpoints and servers, assess their level of exposure, and then immediately secure these servers and endpoints with laser-sharp segmentation policies?...

What's the point of habitual cookie consent? Analytics?

Last week I read an online post about schoolchildren who are taught in their IT lessons to just accept cookie consent pop-ups when they see them on the screen! That really is the definition of habitual consent. If we think about the intent of consent, it should be informed, unambiguous, and...

Akamai's Polymorphic AI Framework Preemptively Manages Bots

Too many security efforts react to threats as they come. While security teams often succeed through Herculean efforts, being constantly under siege takes its toll on your resources. The relentless barrage of bot attacks will eventually crack the human- and system-based methods to block or mitigat...

Making the Edge Come Alive

In April 2019, Netflix viewers streamed 164 million hours of on-demand content per day. Fast forward a year. In April 2020, Twitch streamed 55 million hours per day. The vast majority of that was live. We have seen the future of video. It is live. But live workflows have challenges and requiremen...

Guardicore Centra Integration now available on CyberArk Marketplace

Privileged Access Management is part of a zero-trust model. Guardicore strengthens its offering by integrating with CyberArk...

Akamai y Exceda: Maximizar en conjunto el valor de clientes y socios de América Latina

Hoy, Akamai anunció un acuerdo para adquirir Exceda, nuestro socio de canal más grande de América Latina. Quiero compartir lo que esta adquisición implica para nuestros clientes y socios, y el motivo por el que me emociona enormemente el potencial que esto representa para todos nosotros. Exceda,...

Traffic Management for Peace of Mind

Ensure Quality of Experience and Readiness with CDN Capacity Overflow Have you ever planned and launched a system with painstaking detail and, at some point in time, something unexpected breaks the system? An unexpected event might be an unanticipated scenario a bug! or user adoption beyond...

Introducing the Bot Endpoint Protection Report

Todays comprehensive monitoring capabilities in Security Center provide great insight into bot activity and countermeasures applied across your valuable web properties. Filter options allow you to focus on almost any desired detail. However, understanding what is happening on specific protected...

What You Need To Know About The "ROCA" vulnerability

By Daniel Franke, Infosec Researcher Akamai is aware of the recently-disclosed "ROCA" vulnerability in cryptographic firmware used in products made by Infineon Technologies. A bug in the firmware's prime-search algorithm used for RSA key generation results in RSA keys that are relatively cheap an...

KRACK Vulnerability in WiFi WPA2

Akamai is aware of a family of vulnerabilities known as the Key Reinstallation Attack or KRACK. These vulnerabilities abuse implementation flaws found in all modern wireless networks using WPA2. The KRACK attack is effective at the protocol level and therefore affects all systems using current Wi...

What Are Domain Generation Algorithms (DGAs) And Why You Should Care?

Last time I talked about how a proactive approach to defending against targeted threats using cloud-based recursive DNS and threat intelligence just makes sense. Taking this proactive approach early in the killchain can help mitigate known and unknown threats before any IP connection, file downlo...

CVE-2024-4577 Exploits in the Wild One Day After Disclosure

Akamai researchers have observed numerous exploit attempts for the PHP vulnerability CVE-2024-4577 as early as one day after disclosure...

HTTP/3 and QUIC: Past, Present, and Future

You may have seen the announcements over the past two weeks -- the IETF QUIC RFCs have been published! That leads to a lot of questions, depending on how closely you've followed this space. You might be wondering what this means to you, or you might think QUIC has been an established thing for...

Akamai Provides Prolexic DDoS Service Impact Update (Status: Resolved)

Akamai experienced an outage for one of its Prolexic DDoS services Routed 3.0 starting at 4:20 AM UTC. We detected the issue immediately, and impacted customers received an error alert within seconds. The impact was limited to Akamai customers using version 3.0 of the Routed service. Many of the...

Akamai Identified as a Leader in DDoS Mitigation by Forrester

This week, Akamai was again recognized as a Leader in the latest The Forrester Wave™: DDoS Mitigation Solutions, Q1 2021. Akamai has also been recognized by Forrester as a Leader in its most recent The Forrester Wave™: Zero Trust eXtended Ecosystem Platform Providers, Q3 2020, The Forrester New...

Inspiring the Next Generation with DigiGirlz

photo courtesy of Microsoft DigiGirlz is an initiative organized by Microsoft to engage girls in technological education and careers. The initiative, which launched in 2000, consists of two main programs: DigiGirlz Day and High Tech Camp. This program has been a cornerstone of Microsoft's communi...

Enterprise Application Access Increases Security for Your Enterprise Applications -- and the Data Behind Them

Companies all over the world are moving rapidly to enable their entire workforce to work remotely due to the current environment. Akamai's Enterprise Application Access solution is designed to provide fast and secure remote access to enterprise applications and can be deployed and scaled up quick...

Why DNS Visibility Matters in Education

My colleague in Spain recently wrote an informative article about DNS Protection and why it's a must-have security solution for any company. Building out on this topic, I would like to look specifically at the Education market and what the consequences can be if DNS Visibility is not taken...

John Summers Q&A - Evanta Global CIO Executive Summit

Akamai's John Summers, VP & CTO, spoke at the recent Evanta Global CIO Executive Summit, a gathering of 75 major organization CIOs. His session was titled, "Cloud Security - Adopt Zero Trust and Put Asset-Level Safeguards in Place." Here are some of the key questions he addressed. How do you...

Memcached-fueled 1.3 Tbps attacks

At 17:28 GMT, February 28th, Akamai experienced a 1.3 Tbps DDoS attack against one of our customers, a software development company, driven by memcached reflection. This attack was the largest attack seen to date by Akamai, more than twice the size of the September, 2016 attacks that announced th...

Winning at Launch Time

Your extraordinary work on game development through concept to crunch, your tireless community building, brand awareness, and engagement all converge on one moment: Launching the game. Is it possible to ever finish building a video game? The longer the dev cycle, the more likely it is you'll run...

Akamai IT Challenge - 100 apps on EAA in 100 days

About a month or so ago I shared a quick video interview with Joe DeFelice. Joe is a Sr. Director Enterprise Security & Infrastructure Engineering here at Akamai. In the video Joe outlines a few of the major initiatives he and the team are working on, including moving towards eliminating the VPN...

The OWASP Top 10 for LLM Applications 2026: From Model Risks to Agentic Security

...

Zero Trust Network Access Is an Oxymoron

Though Zero Trust is really quite simple and should be viewed as a very strong form of the age-old principle of least privilege, that does not mean that it is the same thing. In fact, one of the most significant differences from what came before is that when it comes to access, Zero Trust is base...

Building an A/B Test with EdgeWorkers and EdgeKV

This blog was co-authored by Tim Vereecke, Josh Johnson, and Medhat Yakan This is a blog series about building an A/B test with EdgeWorkers and EdgeKV. Read part two here. When paired with our new EdgeKV distributed key-value database, the Akamai EdgeWorkers serverless platform gives you the...

Supporting COVID-19 Vaccine Rollouts with Vaccine Edge

Global efforts to produce and distribute the COVID-19 vaccine continue to race ahead. But in many cases, that race is an uphill climb. Beyond the challenges in making enough of the vaccine, educating the public, and the logistics of distributing the doses, there is a new challenge. Bots. In recen...

Working Together with Our Customers to Build a Sustainable Future

By now, we hope you've read Monday's and Tuesday's blog posts announcing the release of our annual sustainability report, our sustainability program, and the technical innovation behind it. Whilst it's clear Akamai has made great strides on sustainability, in this blog post I will discuss the...

PART I: Retrospective 2020: DDoS Was Back -- Bigger and Badder Than Ever Before

Never before has the risk of a distributed denial-of-service DDoS attack been higher. In 2020, we saw record-breaking attacks, a DDoS extortion campaign impacting thousands of organizations globally, more emergency customer turnups, and more Akamai customers attacked than any year on record -- an...

Is Black Friday a Thing of the Past? Not for Mobile

I recently ordered a new Weber grill from The Home Depot. When it was delivered, I discovered it was the floor model, and it wasn't the perfect grill I had anticipated. I called the local store, and -- long story short -- my friends at The Home Depot gave me a significant discount for not letting...

Platform Update Highlights for eCommerce

Akamai's October Platform Update offers a ton of new features for our customers across all industries. But if you're an online retailer, you should really be paying attention to improvements to EdgeWorkers and Image & Video Manager, which provide expanded capabilities for creating new microservic...

Measuring & Improving Core Web Vitals

Google recently announced a proposed update to its search ranking algorithm: the Page Experience Update. This change, which launches in 2021, includes more performance signals in the ranking algorithm. A subtle but important feature of the update is that AMP will no longer be a requirement for...

Akamai: Supporting Development at the Edge

The pressures on application and web development teams to deliver exceptional customer experiences have never been greater than they are at this time. With consumer expectations growing, the ability of developers to deliver fresh, leading-edge digital experiences confidently and at high velocity ...

Getting Sassy About SASE - the Value of Edge Security

As a former Gartner analyst and now a strategist at Akamai, I have had several conversations with CISOs across the world on the topic of 'designing a future-ready security architecture'. The fact that so many CISOs are seeking a newer, and more effective, security model is a sign that the busines...

Simplifying Data Center and IaaS Visibility and Protection

Helping customers further secure their on-premises data centers and IaaS deployments is an interesting new use case for our Enterprise Threat Protector service. Enterprises typically have a significant number of applications that are deployed and run in these environments. I'm using the word...

DNS Protection: A "Must" in Security Solutions for any Company

Domain name system DNS services are often a point of vulnerability for businesses, so DNS security has become a growing concern for many of them. DNS is a critical element for all companies because it turns domain names into internet protocol IP addresses. Cyber criminals have been digging into D...

The Market of Billions -- Are You Prepared For The Peaks?

Yes, we truly are the market of billions! I love Graham D. Brown's distinctive representation of this massive business opportunity in South Asia in his Asia Matters report. In 2018, over 50% of the world's total online retail sales happened in the Asia-Pacific region. eMarketer reports that onlin...

API Gateway -- Secure API Traffic with OAuth 2.0 and Cache GraphQL Responses

APIs are the connective tissue between software and modern digital experiences, and they must be exposed to consumers in a way that prevents misuse. This means your APIs must have appropriate governance authorization, authentication, quota management policies to prevent consumers from abusing API...

Find AND Fix First- and Third-Party Issues with the Power of Real Data and Adaptive Performance

It's been well established that there is a correlation between fast digital experiences and positive business results. What users experience on a site has a direct bearing on their engagement and buying behaviour and consequently the overall success of the business. Slow page load times can lead ...

Unwelcome Interruptions

Imagine your player's first experience with your game. Finally, after waiting all these years, she's got the game in hand. She tears the cellophane, cracks the case, slots the disc, and . . . "Game is now updating. Please wait." Watching 20 GB load onto a machine is not anyone's idea of fun. I ha...

Finding the Cracks in the Wall - The Hazard of Single Authentication Factor

The use of authentication factors, one of the most fundamental and well understood concepts in information security, enables secure access to applications, services, and networks. It can affect an enterprise's security posture, however, as the drastic increase in data breaches and system attacks...

Two months of Black Fridays?

Black Friday began in the U.S. as a way to funnel Thanksgiving holiday free time into a day of wanton gift shopping. It later spread globally as a retailer promotional blitz to kick off the holiday shopping season. Enter: Black Friday, 2020 style. In early September, many retailers, including Hom...

Stuck Inside, the World Turns to Online Gaming

In my line of work, we talk a lot about traffic trends. They're usually predictable and based around certain events: a major trailer launch, Black Friday in the U.S, the Olympics. But the COVID-19 pandemic has derailed all expectations for 2020, and has itself become a noteworthy event, driving i...