|
By Venkatesh Sundar
Breaking into an organisation’s IT infra doesn’t always require complex methods. Hackers often exploit normal applications and API functions in unexpected ways to access sensitive data. For example, the 2019 Venmo breach involved the exploitation of an open API to scrape millions of payment records. A design oversight in the API allowed attackers to exploit its normal functions in an unintended manner—scraping payment records without proper authorization.
|
By Arvind Sastry
Discover the power of our new WAAP dashboard, designed to effortlessly monitor, analyze, and enhance your security posture—all in real time. The dashboard provides enhanced visibility and actionable insights to secure assets, prioritize remediation, and address critical exposures. Instantly find answers to questions such as: What is my application’s protection status? What common attacks does the WAAP protect against? Which countries are the top sources of blocked traffic?
|
By Vivek Gopalan
By now, everyone is aware of the CrowdStrike Falcon update that caused major disruptions to key services such as hospitals, flights, news channels, and millions of end-user and cloud-based Windows machines worldwide. Details, including recovery options, can be found in the CrowdStrike advisory. At Indusface, designing for failure is a core tenet that we use while building all our SaaS products. After all, despite the best processes, checks, and balances, any system can fail.
|
By Vivek Chanchal
Apache HugeGraph-Server, a popular open-source graph database tool, has been found to have a critical security vulnerability tracked as CVE-2024-27348. The vulnerability allows remote code execution (RCE), giving attackers the ability to execute arbitrary commands on vulnerable servers. This blog explores the details of this vulnerability, its impact, and the necessary mitigation steps to protect affected systems.
|
By Vivek Gopalan
As the importance of APIs continues to grow and API traffic accelerates, ensuring their secure functionality is no longer an option—it is a necessity. Just think about recent hacks like the ones at T-Mobile and Finsify’s Money Lover app – which left millions of users exposed and vulnerable. As cyber threats evolve faster than ever, the quest for the perfect API security solution becomes a mission. With so many options, how do you know which fits your needs?
Over 100,000 websites fell victim to a recent web supply chain attack through the Polyfill JavaScript library. This incident underscores significant vulnerabilities in third-party script integration across the web. This article covers what Polyfill does, why it’s now a threat, and the steps you should take if your website relies on it.
Our latest application security report shows a significant rise in bot attacks, jumping from 59.4 million in Q1 2023 to 147 million in Q1 2024—a 147% increase. These automated programs can disrupt services, compromise sensitive data, and threaten the integrity of online operations. To effectively mitigate these risks, businesses must adopt a robust bot protection solution.
The cloud offers unparalleled flexibility and scalability, from data storage to maintaining an online presence. However, this increased reliance on cloud infrastructure also brings heightened risks, particularly from DDoS attacks. Recent incidents underscore the urgent need for robust DDoS protection. For instance, the HTTP/2-based DDoS attack peaked last August, reaching over 398 million requests per second.
|
By Vivek Gopalan
An application layer DDoS attack, also known as a Layer 7 (L7) DDoS attack, targets the application layer of the OSI model. This type of DDoS attack focuses on disrupting specific functions or features of a website or online service. Layer 7 attacks leverage loopholes, vulnerabilities, or business logic flaws in the application layer to orchestrate the attacks. Here are the key characteristics and methods: Examples of L7 attacks are Slowloris, GET/POST Floods, etc.
|
By Venkatesh Sundar
If your device suddenly behaves like a re-animated zombie, it might be under a botnet attack. Botnet attacks, also known as zombie armies, involve hijacking internet-connected devices infected with malware, controlled remotely by a single hacker. These attacks can reach immense scales, as demonstrated by an incident where 1.5 million connected cameras were exploited to overwhelm and take down a journalist’s website.
|
By Indusface
Overview: According to TechTarget, 94% of organizations experience security problems in production APIs, and one in five suffers a data breach. The primary reason is that most tech leaders assume that having a strong authentication and authorisation framework is enough to secure APIs. As a result, cyberattacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise. Join Karthik Krishnamoorthy, CTO and Vivekanand Gopalan Gopalan, VP of Products at Indusface, in this webinar as they demonstrate how APIs can be hacked.
|
By Indusface
Overview: Periodic security audits and compliance requirements have been a major source of stress for IT and security leaders. Especially as they demand a clean, zero-vulnerability report every 6-12 months in highly regulated industries. That is a big challenge in the face of hundreds of open vulnerabilities and zero-days. With this in mind, we have launched, SwyftComply on AppTrana WAAP. With SwyftComply, you’ll be able to get a clean, zero-vulnerability report within 72 hours.
|
By Indusface
Data Protection best practices from Digital Data Protection Act 2023 by MeitY - SaaSTrana Podcast.
|
By Indusface
As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role. However, navigating the array of deployment options and pricing structures can be daunting, making it challenging to accurately calculate ROI. In this webinar, Vivek Gopalan (VP of Product Management at Indusface) unravels the intricacies of estimating ROI for WAAP.
|
By Indusface
CVSS score is valuable for assessing open vulnerability risk. However, despite the obvious difference in risk, CVSS scores overlook the distinction between vulnerabilities in staging versus production. This issue compounds with factors such as the number and types of applications, vulnerability types, and zero-day threats. Ultimately, leading to Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.
|
By Indusface
Account takeover attacks have increased by 354% y-o-y in 2023. What’s worse? It takes 11 months to solve an ATO breach. By that time, attackers would have laterally traversed your entire digital infrastructure, including databases. So, how do you protect your organisations against sophisticated ATO attacks that even bypass 2FA? In this live attack simulation, Karthik Krishnamoorthy (CTO) and Vivekanand Gopalan (VP of Products) demonstrate various ways in which account takeover can happen, along with practices to protect your websites and APIs against ATO attacks.
|
By Indusface
SOC 2, ISO270001, PCI, and other regional laws require you to have a clean, zero-vulnerability report. That said, even critical vulnerabilities take 250+ days to patch, especially when these exist in third-party plug-ins, open-source libraries, or legacy code. Compounding the problem are zero-day vulnerabilities like the MOVEit SQLi, Zimbra XSS, and 300+ such vulnerabilities that get discovered each month.
|
By Indusface
Verifying the ownership of your URL is crucial when adding a new website to Indusface WAS. In order to conduct a vulnerability scan on your website or app, confirming ownership of the site or domain is essential to prevent unauthorized access. For URL Verification on Indusface WAS, you can use any of the below methods: Learn how to verify your URL ownership using the HTML File Upload method in this method.
|
By Indusface
URL verification on Indusface WAS via email verification link: Verifying ownership is crucial when adding a new website to Indusface WAS. You would not be allowed to scan a website without the appropriate authorization from the owner. In order to perform a URL Verification on Indusface WAS, you may use this simple email verification method and start scanning your website right away.
|
By Indusface
Verifying ownership is crucial when adding a new website to Indusface WAS. Before conducting a vulnerability scan on your website or app, confirming ownership of the application or domain is essential to prevent unauthorized access. For URL Verification on Indusface WAS, you can use any of the below methods: Learn how to verify your URL ownership using the Meta Tag method. This method provides a secure and efficient way to gain authorization before initiating scanning activities.
|
By Indusface
With the rapid explosion of APIs and the huge exchange of information through APIs, every organization should be concerned about how secure are these APIs? Download this whitepaper to understand the evolving cyber threats to APIs and how to mitigate them.
|
By Indusface
A lot of vulnerabilities notoriously registered themselves in the Internet hall of fame, continuing to haunt giant organizations. When so much is happening around, we are sure you would have missed out on some of the key stories. Read this eBook to stay updated on everything important.
|
By Indusface
Bots are everywhere in today's technology. The fundamental challenge is to detect and block the malicious bots that could destroy your business. Download our whitepaper to understand the importance of a good bot management solution.
|
By Indusface
Web-based attacks are the most common attack faced by many businesses regardless of size. Want to identify the vulnerabilities most prevalent to your business and mitigate them?
|
By Indusface
Whatever may be the reason behind the DDoS attacks, this attack is here to stay and almost anyone can become a victim of DDoS attacks. The key piece to address this attack is the DDoS mitigation plan that organizations have in place.
|
By Indusface
In this time of increasing complex cyber-attacks, you should look across the multiple security vulnerabilities to investigate and mitigate risks to keep your organization safe. This eBook reviews the real security attacks that have exploited vulnerabilities and provides a synopsis of facts and fixes.
|
By Indusface
Website vulnerabilities have become a security nightmare for most businesses. Whether you're an entrepreneur, a CIO, a director of security, a CTO, or something in between, understanding and evaluating risks is critical. And that's exactly where this eBook, can help you.
|
By Indusface
Managed WAF is the best solution available to protect applications from attacks. In this whitepaper, we will try to explore why this is the case and how can WAF be effectively deployed to ensure better efficacy?
- July 2024 (9)
- June 2024 (6)
- May 2024 (8)
- April 2024 (9)
- March 2024 (9)
- February 2024 (10)
- January 2024 (8)
- December 2023 (6)
- November 2023 (7)
- October 2023 (9)
- September 2023 (11)
- August 2023 (9)
- July 2023 (12)
- June 2023 (7)
- May 2023 (11)
- April 2023 (10)
- March 2023 (15)
- February 2023 (13)
- January 2023 (6)
- December 2022 (1)
- November 2022 (4)
- October 2022 (10)
- September 2022 (10)
- August 2022 (5)
- July 2022 (1)
- April 2022 (6)
- March 2022 (1)
- February 2022 (6)
- January 2022 (3)
Secure web applications & APIs with ease. Get fully managed web app firewall & scanner to prevent DDoS & Bot attacks.
Indusface is a SaaS company that secures critical Web applications of 3000+ global customers using its award-winning platform that integrates a Web application scanner, Web application firewall, CDN, and threat information engine. Indusface is funded by Tata Capital Growth Fund.
We make it easy for you to secure your Web and Mobile Applications:
- Managed Web Application and API Protection: Risk Based Fully Managed Web Application and API protection with real time protection against OWASP exploits, DDOS attacks, Bot Mitigation and Zero Day attacks with 24x7 support from security experts.
- Comprehensive application vulnerability detection: Automated DAST Scanner combined with on demand Manual Penetration Testing , False positive removal via manual verification with 24x7 support from Security experts.
- Comprehensive Mobile Application vulnerability detection: In depth Pen-testing with multiplatform coverage including iOS, Android, Windows
- Powerful digital certificates for secure communication: Standard, EV, UCC multidomain & Wildcard certificates for your applications.