ThreatX - Blog

As I talk to customers around the world about securing their applications I've noticed a specific topic keeps coming up more and more often: Securing their APIs - both public and internal varieties. RESTful JSON APIs seem to be the most prevalent these days, but I still hear about SOAP and XML APIs, as well as some customers on the bleeding-edge with GraphQL APIs they want to protect. 

Over the past few years, web and application development has undergone a considerable change. Not only is application development and integration dominated by web and mobile-enabled solutions, but technologies like APIs and microservices are also breaking into the scene. 

While these recent advancements have increased connectivity and productivity, they have complicated application security for many organizations. From botnets to targeted attacks, web applications are the target and successful source for a growing number of malicious threats - nearly 10% growth YoY^*.

In a world that is increasingly fast-paced, continuously evolving, and especially competitive, the Internet of Things (IoT) has introduced an entirely new era of connectivity and productivity. For the most part, consumers and businesses alike would argue that the IoT has transformed our every day lives for the better. From optimizing business processes to automating monotonous, manual tasks, IoT devices are integrated in nearly everything we do. In addition to this, many organizations rely on a web portal for multi-device management. This convenience, however, comes at a cost.

There is an ongoing debate among security professionals surrounding the most effective ways to monitor, detect, classify, and ultimately, block malicious threats. Up to this point, the majority of security solutions hang their hats on monitoring and reacting to binary attacks or action. While this approach may provide the peace of mind that nearly every malicious attack will be blocked, it also results in ample false positives and disruption to legitimate prospect or customer web traffic. The frustration from security teams has prompted the search for another way. Enter, The Web Application Kill Chain. 

Last week, the Apache Software Foundation announced a new Apache Struts vulnerability (CVE-2018-11776) that looks just as bad as the one that took down Equifax last fall. When exploited, this vulnerability allows an attacker remote access of servers running an un-patched version of Struts (2.3 to 2.3.34 or 2.5 to 2.5.17). Thousands of companies running Struts were now potentially facing a serious threat to their systems. Those organizations without a WAF (Web Application Firewall) in place or those leveraging one with outdated signatures may be at risk of compromised systems and exposed data.

Let's talk about the future of application security. For those of us who have been designing network and application security architectures in the past couple decades it's been impossible to notice the pace of change has accelerated in the last few years. Static, legacy architectures are giving way to dynamic, auto-scaled microservices architectures. But can we continue to secure applications developed with CI/CD pipelines using legacy approaches? 

We sat down with Andrew to learn more about his background and journey to CTO, what inspired the development of the ThreatX solution, get his perspective on the future of cybersecurity, and take a look at his new article series on TechTarget's IoT Agenda Blog.

Slow. Antiquated. Android.

Remember the old Android device you used to use? Many of us have old versions of these devices sitting around that worked well 5 or 6 years ago, but are, unfortunately, too slow or outdated to use today. The hardware is lethargic and the Android OS hasn’t been patched for years. This is never more evident than when you try using a web browser on one of these devices and watch it struggle while rendering an element-rich site. The fact is, older devices simply don’t have sufficient CPU power to quickly display a complex page, even those designed to be responsive or mobile friendly.