ThreatX - Blog

We are thrilled to have been selected as a finalist in the SC Media Awards for Best Web Application Solution in the Trust Awards Category. As many of you are aware, the SC Awards are viewed by the security industry as the gold standard of excellence in cybersecurity and we’re in great company with the likes of Imperva, Akamai, WhiteHat Security, and Contrast Security.

In this series of blog posts, we have been analyzing the major forces that are reshaping the way the industry approaches application security.In this post, we lay out the foundations for a new approach to security that not only solves the problems of the old approach to web application firewalls (WAFs), but also addresses the new challenges posed by the changing application and threat landscapes. In case you missed any of the previous sections, you can check them out here:

Friday’s news of Marriott’s massive breach sent shock waves throughout the cybersecurity industry and consumer sectors alike. Brian Krebs described the “colossal intrusion” and numerous other security experts joined in to analyze what missteps the chain may have taken, how the breach could have been prevented, and what we as an industry can learn from the catastrophe.

Historically, there has been no love lost between software developers and security teams. Dev teams are frustrated by the restrictive nature of the security standards placed on them as they often hinder rapid application development. On the flip side, security teams see developers as one of the top threats to the integrity and success of their security strategy.

In this series of articles, we’ve been exploring the various ways that application security is evolving and what it means for modern security teams. In the first article, we analyzed how virtually all applications have evolved to be web-facing in some manner and how this has massively multiplied the AppSec attack surface for most organizations. Next, we addressed the applications themselves and how the evolution of DevOps and new microservice architectures have created new opportunities, as well as new challenges, for security. In this article, we shift our focus to the threats themselves. Here, we will take a look at the many types of threats facing modern applications, some of the challenges they pose to the traditional web application firewall (WAF) model, and how security can evolve moving forward.

While application security has never been more advanced, one could argue that it has also never been more difficult. Keeping pace with the growth and evolution of applications, evaluating the endless number of available solutions, and recruiting the expertise to manage the solutions and evaluate the data are just a few of the challenges modern security teams face. The team at ThreatX is comprised of engineers, developers, and security practitioners that have faced one of more of these challenges in their careers. That's what fuels our passion every day.

On this note, I am writing a multi-article series that addresses some of the key trends and challenges facing application security today and how security teams can adapt. In the first article, I highlight the shift in application development and integration, and the impact on security teams. In this article, I will dive into how new DevOps models are affecting security strategies and ushering in a new age of security tools. 

The Modern Age of Applications

Applications are the heart of most organizations. While you can think of data as the nouns of an organization’s story, applications are the verbs where the action takes place and the real work gets done. And the nature of those applications is changing dramatically - including everything from how they are developed, to how they are accessed, to how they are secured.

It seems that nearly every week, another IoT related security story is in the news. While most of the coverage still focuses on the hardware, organizations often forget the cloud infrastructure that connects the differing threads of IoT devices. These portals are a mega culprit in the complicated and risky security landscape. They are a modern day hacker's keys to your kingdom.