Software Supply Chain Attacks: From Formjacking to Third Party Code Changes

2020 wasn’t the first year in which software supply chain attacks caused major damage, but it certainly brought them to the general public. Much has been said about the headline-grabbing nation state examples, but there is a wide spectrum of these attacks and some are commoditized. Protecting...

The Evolution of Bad Bots from Grinchbots to Parasitic Bots-as-a-Service

The doomsday pandemic prediction is that you wont be able to buy toilet paper because bad bots will have hoarded all the inventory and are offering it to the highest bidder on secondary markets at an exorbitant mark-up. The Gaming Console War The use of scalping bots was once the domain of ticket...

2020 Ends With A Bang

December 2020 was an eventful month in cyber security. This blog recaps three of the major security events we saw towards the end of last year. December began with FireEye’s breach announcement that included a leak of its red team tools arsenal. Quickly after this announcement, Imperva Threat...

The Advantages and Risks of Serverless Computing

Organizations are increasingly embracing serverless computing for its convenience and cost-effectiveness. But many IT teams are blindly embracing this innovation in cloud technology without consulting their security peers. As a result, we can expect to see a growing number of cyber-attacks in thi...

Data Privacy – Now’s the Time for the US to Catch Up

The recent Netflix documentary, The Social Dilemma, may have highlighted to many Americans just what happens to the wealth of personal information they regularly - and willingly - share online. It may be especially concerning, then, to know that companies in the United States aren’t required by...

Opportunities and Threats – IoT and the Rise of 5G

The Internet of Things IoT is expanding rapidly. The number of connected devices in homes, businesses, and vehicles across the world is expected to increase from around 8 billion today to over 24 billion within the next decade, with much of this growth enabled by the introduction of 5G. This...

Lessons learned building supervised machine learning into DDoS Protection

Imperva’s Data Scientists trained a machine-learning model to auto-configure DDoS security policies and this blog shares some of the lessons learned along the way. Data scientists consider labeled data the gold standard and, despite having to filter out anomalies, there is an overall tendency to...

Shifting from Network Security to Data Security

The world-wide events of 2020 have meant that organisations have had to simply react and adapt. More data is being moved to the cloud, applications are built in cloud environments, and more and more databases are being used to support the shift in the way we work. 59% of enterprises believe their...

Virtual Hackathon Generates Next Generation of Imperva Innovation

“How do we run a global hackathon amid a global pandemic?” That was my first thought when I began planning the 2020 Imperva Hackathon earlier this year. While the event is designed to foster innovation and uncover new ideas, in a global company like ours it’s also about making new friends and...

Holidays Are Coming – the State of Security for E-commerce in 2020

With the Coronavirus pandemic driving consumers online, a new report from Imperva reveals how this year’s holiday shopping season will present online retailers with a level of traffic - and cyber-attack threats - like they’ve never seen before. Among the many effects of COVID-19 has been a huge...

Advanced Bot Protection Handling More Traffic Than Ever

It’s been six months since we launched the Advanced Bot Protection solution as fully integrated into Imperva’s Application Security platform. Previously, the Advanced Bot Protection solution lived on a separate platform, known as the ‘Distil’ platform, from our acquisition of Distil Networks...

Imperva SD-SOC: How Using AI and Time Series Traffic Improves DDoS Mitigation

Much has changed since we first started providing protection against DDoS attacks. Attacks which were once considered huge are now mitigated on a daily basis, attackers are becoming more sophisticated by the day, and mitigation takes a matter of seconds, as opposed to minutes, to kick in. But one...

Bug hunting for a quick buck using WebLogic vulnerability (CVE-2020–14882)

Introduction Popular within the commercial sphere, Oracle WebLogic Server is a scalable enterprise Java platform application server for Java-based web applications. When a vulnerability is discovered in WebLogic, hackers will try to exploit it ASAP. And it’s not only hackers - bug hunters also wa...

The Threat of DDoS Attacks Creates A Recipe for Election Chaos

Four years ago, we published a blog on the ways a Distributed Denial of Service DDoS attack could disrupt the U.S. Presidential election. Unfortunately, the same risk persists in 2020. In fact, given the historic influx of mail-in ballot voting for the November 3 election, a targeted DDoS attack...

CrimeOps of the KashmirBlack Botnet – Part II

Introduction The previous blog - “CrimeOps of the KasmirBlack Botnet - Part I” - described the DevOps behind the botnet. It showed how its well-designed infrastructure makes it easy to expand and add new exploits or payloads without much effort,and explained the evolution and version deployment o...

CrimeOps of the KashmirBlack Botnet – Part I

Introduction Being in a research team exposes us to a variety of attacks on different platforms, of different types, scope, and volume. It also gives us the opportunity to select particularly interesting attacks that target our customers and to analyze them. This blog will give you a taste of the...

Imperva A Seven-Time Magic Quadrant Leader and Named Highest for Completeness of Vision for WAF

Gartner has published its 2020 Gartner Magic Quadrant for Web Application Firewalls WAF and Imperva has been named a Leader for the seventh consecutive year! It’s rare to be a part of defining a market and even less common to lead that market through a fundamental shift. Leading the market throug...

Life post-acquisition: A people-centric plan to get you total data security a lot faster

Getting acquired can be an emotional rodeo. Some days are crazy excitement and others are heartache over the unknowns ahead. It’s natural – we’re human. I remember years ago sitting in a doctor’s office staring at a poster about the “10 most stressful life events” and “starting a new job” was 4...

Never Leave Your Cloud Database Publicly Accessible

Introduction In cybersecurity, we often hear about best practices, one of the most important of which is never to open services that should be for internal use to public access. These are best practices for a good reason - when you don’t follow them, you might be hacked! Research we conducted in...

Imperva’s Mobile Security App

How many apps do you currently have on your mobile device? Is this number a total across both your personal and professional devices? Did you know that between Android’s Google Play Store and Apple’s App Store, there are between 2.2 and 2.8 million apps available to download? Did you know that,...

Imperva 收购 jSonar： 新一代数据安全

我很高兴地宣布，Imperva 已达成收购 jSonar 的协议！我们认为，jSonar 令人难以置信的产品和技术与我们保护数据和所有通往数据的路径的使命完美契合。合并之后，我们将能够提供一种全新的数据安全方法，帮助企业满足当前和未来的需求。 Imperva，数据安全的先驱 Imperva 成立于 18 年前，其理念是通过融合应用程序和数据安全来保护组织的数字资产和信息。2020 年，全球最大的公司告诉我们一个道理，所有的安全性（包括网络和应用程序）最终目的都是为了保护数据。从长远来看，网络的存在是为了把人们带到应用程序中，而应用程序则负责读写数据。Imperva...

DDoS Attacks Grow More Sophisticated as Imperva Mitigates Largest Attack

Only a few months ago Imperva reported mitigating against two of the largest DDoS attacks of 2020. However, in the past few weeks we’ve observed a rise in the number of DDoS attacks against our customers where both the volume of attacks and their level of intensity have increased significantly. O...

Providing Security and Acceleration of Single Page Applications

HTTP/2 + gRPC and protobuf Today many digital transformation and DevOps teams have been tasked with building applications that will enhance their customer’s digital experience. The goal, to make the user experience smoother, faster and less impeded by transactional and security controls, is a cor...

Imperva to acquire jSonar: A New Generation of Data Security

I’m thrilled to announce that Imperva has entered into an agreement to acquire jSonar! We view jSonar’s incredible product and technology as perfectly aligned with our mission to protect data and all paths to it. Together, we will be able to deliver a fundamentally new approach to data security t...

Major Global Ransom Denial of Service Campaign Continues Rising Trend in Global DDoS Attacks

Extortionists Claim Connection to Notorious Threat Actor Groups In recent weeks Imperva has become aware of a considerable increase in the number of serious Ransom Denial of Service RDoS threats, with extortion campaigns targeting thousands of large commercial organizations globally, not least th...

When The Going Gets Tough – R&D Calls With Customers – Doing It Right!

Several years ago, I joined the development team of a new product within Imperva. I discovered that direct interaction between us developers and our customers was much more frequent than on more mature products - customer calls are an invaluable tool when developing from scratch. However, these...

Putting Your Data Security at the Center of our Mission

We’re more than just an industry-leading Web Application Firewall! For a long time now, Imperva has been known in the cyber security industry as ‘the WAF company’. The go-to brand for Application Security and Web Application Firewalls. But this is only possible due to our data protection DNA. Thi...

Top Security and Data Privacy Regulations for Financial Services

Regulatory compliance has become an increasingly more important part of the financial services industry in recent years. And it’s a trend that’s likely to continue due to the upsurge in cloud computing, the use of mobile applications, and a shift to IoT devices, all of which are driving exponenti...

Auditing Your Database – Is It Enough For Your Data Security Needs?

Audit trails have been a feature of databases for a long time, but are they still compatible with todays data security demands? What do you need to do, as a security officer, to get the most information about what’s happening to your company’s data? Are audit trail features impregnable to possibl...

From Layers to Microunits

The evolution of “Code Cohesion” and “Separation of Concerns” The software industry has recognized the values of “Separation of Concerns” and “Code Cohesion” for more than two decades. Many articles, books and software-thinkers have contributed methodologies to implement these important values. I...

WAF and RASP: Best Practice for Defense in Depth

Why do you need a RASP solution if WAFs layer of defense is so powerful? The simple answer is that no single security product can provide protection for all threat vectors. A comprehensive IT security strategy includes risk-appropriate controls implemented where they can provide maximum efficacy,...

Imperva mitigates largest DDoS attacks of 2020… so far…

The word “unprecedented” has never been used so much as it has during 2020. And in the latest of many unprecedented events, July saw the two largest recorded DDoS attacks of the year so far. As revealed in our July 2020 Cyber Threat Index Report, published today, Imperva Research Labs recorded tw...

Achieving Product Platform mindset

Imperva has decided to gradually shift to a company-wide Platform mindset in which, instead of having a set of separate products and features, there is a set of capabilities and building blocks upon which the products and features are built. Until now, special Platform teams have developed Platfo...

Fast, Furious, and Scalable: Designing a High-throughput, Real-time Network Traffic Analyzer

These days, our focus is on spoiling our customers. For example, we give our DDoS Protection customers the peace of mind that their network traffic is routing through Impervas cloud for consistent volumetric attack protection. That protection works pretty well, but customers have started asking u...

Avoid Alert Fatigue: How to Automatically Get Rid of WAF False Positive

Alert fatigue - introducing false positives in WAF All WAF experts know what it’s like handling massive amounts of alerts. They’re also very likely wasting a lot of time fishing false positives out of all these alerts. The WAF’s purpose is to block attacks and let legitimate traffic through. Fals...

Automation & Development – Why It’s Worth Investing in This Relationship

Good relationships will be stable whenever something goes wrong. But, if you don’t invest in your relationships, they won’t last long. Let’s take, for example, a little crisis that could happen - a bug is found in the field! … by a customer! “How did we miss it?” will be the question asked all...

Introduction to SQL: Examples, Best Practices and Pitfalls

SQL Structured Query Language has been with us for more than half a century and it’s not going away anytime soon. Popular in both traditional relational databases and newer NoSQL databases technologies, SQL is widely used for data analytics, Big Data processing, coding languages, and more. I’m a...

Dynamic Swagger Support Comes to Imperva

It’s no secret that the shift to DevOps deployments has taken center stage at organizations small and large. The ability to quickly configure, manage and update via APIs is critical to a company’s ability to push out small iterative changes, without human intervention. And Swagger has become the...

Imperva Shields Against Windows DNS Server RCE Vulnerability (CVE-2020-1350)

Recently, Check Point researchers found a 17-year-old high-profile flaw, SIGRed CVE-2020-1350. The flaw is a wormable, critical vulnerability in the Windows DNS server, and can be triggered by a malicious DNS response. On a zero to 10 scale, this vulnerability has received a CVSS base score of 10...

The Anatomy of Massive Application Layer DDoS Attacks

During 2020 between June 18 and June 24 Imperva mitigated massive 200K RPS Request Per Second attacks on a daily basis. Here at Imperva we investigate major attacks we mitigated in order to gain a better understanding of their anatomy and allow for smarter mitigation. In this blog post we’ll...

DDoS Protection for Networks: Combatting Local Preference from ISPs

One of the most common issues we have seen when onboarding customers to our DDoS Protection for Networks service is when a customer’s ISP implements a high local preference. This prevents the Internet from recognizing that Imperva is the best path. Local Preference Local preference is one of the...

How bad bots are targeting the healthcare sector

Credential cracking, or password spraying, is one of the most effective ways for cybercriminals to get access to user accounts. It refers to the brute-force automated cracking, or pairing of usernames and passwords by using sophisticated high-speed bots. According to a National Cyber Awareness...

Introducing Imperva Cloud Data Security

We are excited to announce that our latest data security innovation is now available worldwide! Made for the cloud, Imperva Cloud Data Security CDS builds on our industry-leading application and data security solutions, providing an industry-first, complete cloud data SaaS security solution that...

Australian Cyber Attack Vectors Blocked Out of the Box by Imperva WAF

On June 18, 2020, the Australian Cyber Security Centre ACSC released a disclosure detailing a ‘sophisticated’ and sustained attack against Australian government bodies and companies. The disclosure was covered by several mainstream media outlets including the BBC, and the Guardian. The following...

Why should you worry about DNS attacks?

Domain Name System DNS is a very basic protocol and service that enables Internet users and network devices to discover websites using human-readable hostnames instead of numeric IP addresses. This article provides a detailed explanation of how DNS works. If the DNS service is attacked or doesn’t...

Imperva Prevents Client-Side Attacks like Formjacking and Magecart

The Blindspot of Web Security is Client-side Code One of the troubling blindspots for security teams is third party JavaScript services embedded on a website. The popularity of JavaScript services used by developers and marketing teams means this blindspot is hiding an expanding attack service. I...

DDoS Protection for Networks: Divert Traffic Using More Specific Routing

In our previous blog post, we talked about AS autonomous system prepending, but sometimes a customer might have restrictions that would not allow them to use AS prepending. If the customer owned more than a less specific prefix, for example /23 prefix, they could advertise a more specific route...

Key Elements for DDoS Detection, Mitigation and Analysis

Given today’s volatile DDoS threat landscape with attacks ranging from massive volumetric assaults to sophisticated and persistent application level threats, comprehensive protection is a must for online businesses. But what are the most important considerations for evaluating potential solutions...

DDoS Protection for Networks: Utilizing AS Prepending to Route Traffic Through Imperva

In order for Imperva to protect customers’ traffic using DDoS Protection for Networks, the Internet must select Imperva as the best path. So what does this mean? Does Imperva automatically take over the customer’s prefix and control the routing of the Internet? Well…not exactly. Internet Routing...

Open Banking Around the World

Open Banking, the practice of sharing financial data with competitors and third parties via open APIs, offers many benefits for consumers who not only have more control over their data, but who can now manage their finances much more efficiently. What started with the European Union Payment...