Threat X Labs - Blog

In a world that is increasingly fast-paced, continuously evolving, and especially competitive, the Internet of Things (IoT) has introduced an entirely new era of connectivity and productivity. For the most part, consumers and businesses alike would argue that the IoT has transformed our every day lives for the better. From optimizing business processes to automating monotonous, manual tasks, IoT devices are integrated in nearly everything we do. In addition to this, many organizations rely on a web portal for multi-device management. This convenience, however, comes at a cost.

There is an ongoing debate among security professionals surrounding the most effective ways to monitor, detect, classify, and ultimately, block malicious threats. Up to this point, the majority of security solutions hang their hats on monitoring and reacting to binary attacks or action. While this approach may provide the peace of mind that nearly every malicious attack will be blocked, it also results in ample false positives and disruption to legitimate prospect or customer web traffic. The frustration from security teams has prompted the search for another way. Enter, The Web Application Kill Chain. 

Last week, the Apache Software Foundation announced a new Apache Struts vulnerability (CVE-2018-11776) that looks just as bad as the one that took down Equifax last fall. When exploited, this vulnerability allows an attacker remote access of servers running an un-patched version of Struts (2.3 to 2.3.34 or 2.5 to 2.5.17). Thousands of companies running Struts were now potentially facing a serious threat to their systems. Those organizations without a WAF (Web Application Firewall) in place or those leveraging one with outdated signatures may be at risk of compromised systems and exposed data.

Let's talk about the future of application security. For those of us who have been designing network and application security architectures in the past couple decades it's been impossible to notice the pace of change has accelerated in the last few years. Static, legacy architectures are giving way to dynamic, auto-scaled microservices architectures. But can we continue to secure applications developed with CI/CD pipelines using legacy approaches? 

We sat down with Andrew to learn more about his background and journey to CTO, what inspired the development of the Threat X solution, get his perspective on the future of cybersecurity, and take a look at his new article series on TechTarget's IoT Agenda Blog.

Slow. Antiquated. Android.

Remember the old Android device you used to use? Many of us have old versions of these devices sitting around that worked well 5 or 6 years ago, but are, unfortunately, too slow or outdated to use today. The hardware is lethargic and the Android OS hasn’t been patched for years. This is never more evident than when you try using a web browser on one of these devices and watch it struggle while rendering an element-rich site. The fact is, older devices simply don’t have sufficient CPU power to quickly display a complex page, even those designed to be responsive or mobile friendly.

It's no secret that the frequency and intensity of data breaches is growing at an exponential rate. Based on data from Verizon's Data Breach Investigations Report, there were nearly 53,000 incidents and over 2,215 confirmed breaches in a mere 12 months. This confirms the fear that many organizations face that hackers are thriving in an expanded playing field, and organizations don't have the resources or the bandwidth to keep up. 

In response to this and similar trends, businesses are commonly resorting to impulse investments in technology and resources that promise stronger defenses. Unfortunately, these rash decisions often cause security strategy misalignment - the results of which often mirror the likes of data breaches in their negative impact on the business.

On August 8 and 9 in Las Vegas, thousands of cybersecurity enthusiasts, practitioners and executives will be in attendance at Black Hat 2018. We are thrilled to be among the participants at this year's event.