Radware

[radwareblog-blog]

DevOps Brings the Cloud to Application Development

by Frank Yue

Applications need to change quickly and easily in today’s fast-paced world of the internet. DevOps is bringing applications the ability to morph and evolve the same capabilities that the cloud has delivered to IT infrastructures. Applications require constant adjustments and fine tuning to meet consumer and market requirements. DevOps offers application development a flexible process model that delivers the agility and elasticity benefits found in cloud architectures.

Cloud for the programmers

Cloud technologies blossomed because they provided the agility and elasticity that businesses needed to ensure that their applications were delivered reliably and efficiently. The effective delivery of applications, internally and externally, is essential to almost all businesses in today’s market environment.

To review, agility is the ability for application delivery architectures to add and remove services quickly and easily. The addition or removal of an application or component of an application cannot take weeks or months. Elasticity is the ability for the IT infrastructure to scale resources to meet demand.  When client demand increases, or decreases, the application delivery infrastructure needs to be able to accommodate the necessary changes to the available resources to meet the demand without disrupting the service.

Read more: http://ow.ly/qS5q303ILhr

[radwareblog-blog]

Newsrooms and Automation

by Carl Herberger

Cyber-attacks and data breaches routinely make headlines in the largest publications and broadcasts in the world.  Millions have read and watched as news journalists explain exactly what had happened during the Proton Mail attack or the BBC hack.  The access and manipulation that can happen when communication outlets are targeted is a very real and dangerous issue.  

This issue, however, is complicated by the unique operating environments of these cyber-attack targets.  Multiple locations, countless access points and very motivated attackers all contribute to the complex task of network protection.  As cyber-attacks become more automated and more sophisticated, the adaptability of security professionals is paramount.  

Read more: http://ow.ly/re0Y303zPzV

[radwareblog-blog]

Securing Online Assets: Four Steps to Protect Your Online Business

Businesses of all sizes, across all verticals, generate significant sales online, increasing their risk and exposure from outages and breaches. Unfortunately, malicious actors understand this and target online businesses with this in mind. By and large, their efforts are successful. According to Radware’s 2016 Global Network and Application Security Report, 62% of those attacked suffered downtime or degradation. According to this same report, organizations now see more tangible financial impact from cyber-attacks. Over two-thirds (69%) of organizations say attacks cause revenue, customer, partner, and productivity loss (up from 45% last year).

Attacks aren’t just about outages or breaches, performance degradation caused by attacks are a growing problem as well. According to recent studies, 40% of customers will now wait 3 seconds or less before moving on to a competitor site, meaning the impact of performance loss is extremely tangible for online businesses.

Read more: http://ow.ly/D0Pu303xwOA

[radwareblog-blog]

4 Reasons to Believe Future Cyber Attacks Will Terrorize

by Carl Herberger

For years people have been talking about the threat of a Cyber Pearl Harbor or Digital September 11th event.  There is a perception that this event would be an isolated incident that cripples society as we know it – heck, there is even a TV show about it. But what are the possibilities for such an occurrence in reality? Let’s take a look at three realistic categories where cyber terrorism is either already upon us or having its comeuppance.  

Let’s look at four attack profiles which would reasonably either lead to loss of life or have the potential to leave the victim inevitably stricken with fear:

PUBLIC SCENARIO ONE: Large Scale Communications or Power Outage especially during a Terrorist or Natural Crisis Event

We’ve known for quite some time that cutting off communications during crisis periods will impede first responders’ situational awareness, exacerbate suffering and pain and might increase the loss of life.   This means that the Pearl Harbor event of our time could consist of multiple components, including a physical attack, with a corresponding cyberattack component that targets the communications systems first responders use to contain and minimize damage.  

Read more: http://ow.ly/IAp2303vfF0

[radwareblog-blog]

Why Online Retailers Should Be On High Alert for Cyber-Attacks

by Ben Desjardins

The close of summer in the United States brings with it one of the most important online selling seasons for Internet retailers: Back-to-School (BTS) shopping. This critical shopping season trails Cyber Monday closely as the most important for online generated revenue for many retailers. According to a recent study by Field Agent, a research firm specializing in retail, nearly two-thirds of U.S. consumers plan to purchase at least some of their BTS goods online. So, naturally this is a time of year that the security teams for major online retailers need to be on high alert, keeping an eye out for any attacks that can disrupt operations or breach sensitive data. It’s also a time they need to worry about malicious actors targeting customers with phishing attacks, even if there’s little they can do directly to prevent them. With average consumers in U.S. planning to spend between $500-$1,000 on BTS shopping, any impediment to consumer sentiment and quality of experience can have dramatically bad effects.

Given the timeliness of the topic, let’s explore some of what we, at Radware, are seeing as significant trends both in the threat landscape targeting online retailers, but also changes they are making in their IT and business that play into the cyber threats.

Read more: http://ow.ly/USAu303mhUm

[radwareblog-blog]

5 Reasons Why Kids Are Hacking Schools

Summertime is almost over, and back-to-school season is upon us. Beginning now, students all across the globe are beginning to register for their classes, purchase their school supplies, and start working on assignments for the upcoming year. But among these students, there are some who will get up to no good – hacking into the school systems to alter records, to disrupt the school’s normal operations, and to see just how much damage they can do. Let’s take a closer look at some of the reasons why kids are hacking their schools:

1. It’s fun. What kid wouldn’t be intrigued by the idea of trying to hack into their school, with all its records at their disposal? With many teachers electing to have students submit assignments digitally and take exams online, some kids would find it fun to shut down the system so they and their classmates won’t have to submit their work or take a test.

Read more: http://ow.ly/mnbD303k3Rp

[radwareblog-blog]

DevOps is Changing IT Organizations 

by Frank Yue

IT organizations need to adjust their structures and processes to adapt to DevOps.  DevOps is making application development more streamlined and agile.  The continuous development models that DevOps brings to IT requires significant changes to IT organizations and the way they interact with each other. The success of DevOps depends on its integration into evolving business models.

DevOps covers continuous development processes and agile models that allow businesses to modify, update, and deploy application changes quickly and easily.  Where traditional development models have discrete handoffs between teams and cycles, DevOps introduces the ability for developers to make changes and push them through the development and production systems quickly and easily.

Read more: http://ow.ly/ARJB303i119

[radwareblog-blog]

The Rise of Booter and Stresser Services

by Daniel Smith

Stressers

Denial of Service (DoS) attacks have come a long way since the days of LOIC and other GUI-based tools. Today, potential hackers do not have to know the first thing about conducting such an attack. They can simply purchase attack services to carry one out for them. Just a few years ago, attackers would have had to download simple GUI-based tool to launch a DoS attack. As time moved on, hackers started to combine their efforts and tools in distributed group attacks. Today, attackers are now abandoning GUI and script tools and opting to pay for attack services via stresser services.

Read more: http://ow.ly/Muow30396gg

[radwareblog-blog]

In the Crosshairs: Six Cyber Security Threats Gunning for Your Online Business

In today’s hyper-connected world, nearly all businesses, regardless of size or industry, have some element of their operations based online. From the largest online retailers and financial service companies to gaming and social media brands, organizations are transforming how they conduct business and have become increasingly dependent on network-based services. Even the smallest service-oriented organizations rely on the Internet for ecommerce or as a platform to deliver services to employees and partners.

These pros also come with some cons. Online businesses have become juicy targets for cyber assailants. Certain industries face a heightened level of threat due to the unique level of business operations and revenue generated online. The threat landscape targeting these organizations is growing in virulence, driven by hackers seeking to take advantage of the knowledge that these businesses cannot afford downtime or loss of customer trust.

Read more: http://ow.ly/zb5S3036AwO

[radwareblog-blog]

Expectation management - What can vendor management systems do for you?

by Ben Zilberman

Have you noticed all management systems promise the same value? Have you ever met a vendor who did not offer “advanced automation,” “flexible customization” and “granular visibility”?

The fact that all vendors promise the same values makes you doubt the necessity of their management consoles. After all, you are buying their solution for a certain purpose – whether for security, networking, virtualization or application. So do you really need that system?

The surprising answer is – it depends. It depends on what your expectations are, and depends on the management system’s ability to fulfill them.

Purchasing a new solution in the information-flood era is a sweat-producing task.  For months you have been evaluating several solutions, testing various technologies and negotiating with clever sales reps on one hand and your strict procurement team on the other.

And then, right before you make your final decision and get some well-deserved relief comes your selected vendor, who tries to upsell their management system. Do you really need it?

Read more: http://ow.ly/BUZd3034ovs

[radwareblog-blog]

Dry Lighting Cracks against the Cloud:  The Rise of the Advanced Persistent DoS (APDoS)

by Carl Herberger

So, let’s say you are up to no good and motivated to attack somebody or some organization.

After somewhat thoughtful considerations you decide you are going to launch a cyberattack to render your victim unavailable or to extort some sort of action or ransom.  

However, you have a big problem to solve - - how do you get around today’s most popular Cloud Security Scrubbing Businesses?  

Well, as the attacks on ProtonMail last November have demonstrated, change the profile of the attacks frequently and leverage a persistent and advanced tactic of revolving attacks geared to dumbfound detection algorithms. This is called APDoS.  

Read more: http://ow.ly/UqDw302Vh17

[radwareblog-blog]

5 ways hackers market their products and services

by Daniel Smith

Hackers all over the internet today are slowly adapting to the changes in the attack marketplace.  Many notorious DDoS groups like Lizard Squad, New World Hackers and others have already entered the DDoS as a Service business, monetizing their capabilities in peace-time by renting out their powerful stresser services. But it’s not just DDoS. It’s all attack services including application-based attacks. These marketed services are now allowing novice hackers with little know-how to launch attacks via affordable tools that are available on the Clearnet.  This growth is healthy for any market but has forced vendors to take on more of a traditional marketing strategy.

Flashing banners, weekly promotions and customer service are all keystones to a successful marketing plan, but are now becoming cornerstones for attack vendors as well. Vendors that are selling attack services are using modern marketing techniques but they are also using multiple platforms to market their goods and services, just like a large firm would do. Often times you can find the hackers selling or marketing discounts for their services on Twitter, Facebook and other social media platforms. Social media is an important platform for the attackers since this is the first place the media and spectators will look when a large service goes offline.

Read more: http://ow.ly/T2IN302Th9J

[radwareblog-blog]

Buy Me Some Peanuts and Database Hacks

by Ben Desjardins

It’s late July and the ‘boys of summer’ are in full swing, if you’ll pardon the pun. I’m a huge baseball fan and love most everything about the sport, including the mystique surrounding many of its unwritten rules. These rules, as their name suggests, cannot be found in any official rule book issued by Major League Baseball or other governing bodies. Nonetheless, they are firmly planted in players’ and coaches’ minds, and have their own system of self-policing administered mostly on the field. Typically penalties come in the form of a high-inside fastball for those that break them. Among the most established of these unwritten rules is the stealing of signs, a practice with many infamous examples throughout the game’s history. My personal favorite sign-stealing story surrounds the Chicago White Sox, who reportedly used a single light bulb in the centerfield scoreboard, turning it on-or-off to signal pitches to the home team batter.

Read more: http://ow.ly/KCnA302Qulz

[radwareblog-blog]

Pokemon Go Does Not Have to Be Down or Slow

by Frank Yue

Ever since Pokemon Go was launched, there have been constant connectivity and performance problems for players around the world. It has been 20 days since the game was released and there are still times when players cannot log in or connect to the game. Sometimes, the game launches, but the environment is empty as the application tries to support the massive player demand.  In addition, it is likely that hackers are launching DDoS attacks against the game infrastructure in an attempt to gain some media attention that has been closely following the game.

This does not have to be the case and there are best practices that Niantic, the developer of Pokemon Go, and Google Cloud, the host for the application, can do to alleviate these issues. Here are some points businesses should take into consideration when building online applications to ensure their availability:

· Elasticity – Use technologies to ensure that the resources for the components of an application (authentication, server, database, etc.) can be added as needed to meet the current demand.  Use load balancing technologies and cloud orchestration models that create a flexible and on-demand infrastructure. When more players attempt to connect, application servers can be added to the resource pool dynamically, automatically, and transparently to ensure that the clients do not time out or take a long time to connect.

Read more: http://ow.ly/DynR302H1Uz

[radwareblog-blog]

How to sell NFV

by David Island

Is Network Function Virtualization (NFV) a market inflection point, or just an over hyped technology in search of a use case?

· NFV is designed to use x86 hardware, which translates to improved capital efficiencies compared with dedicated hardware implementations.

· Software-based NFV deployment alongside real-time SDN network programing results in rapid service introduction and improved operational efficiencies.

· As NFV enables the decoupling of network functions and their physical location, services can be instantiated at the most cost effective location, in addition to multi-site application availability, scalability and cloud burst real time deployments.

· End to end service life cycle management resulting from common automation and operating procedures translates into operational cost reduction

· Open and standardized interfaces between virtualized network functions and the infrastructure enables service provides to avoid vendor lock in. Each service provider can select its own best-in-class options and run in a multi-vendor environment.

Read more: http://ow.ly/XV45302EIAD

[radwareblog-blog]

Microsoft TMG Replacement Blues?

by Prakash Sinha

Microsoft has discontinued Forefront Unified Access Gateway (UAG) and Forefront Threat Management Gateway (TMG), solutions for remote application access control, security and optimization. Microsoft UAG/TMG evolved over many years to integrate multiple functions to protect Microsoft applications. It is a key component of several Microsoft application deployments including Microsoft Exchange, SharePoint and Lync. However, the TMG and UAG deployments are not limited to protecting Microsoft applications.

Securing web applications accessible over the web is a complex task. A compromise may lead to a significant performance hit to the application, especially when under an attack that may impact business, or worse, security breaches.

As these products approach their end of support (April 2020), a common question from customers is “What do I do to secure my Microsoft Exchange or SharePoint deployment?” Although some of the security functions are integrated into new Microsoft products, there is no direct replacement of TMG and UAG from Microsoft.

Read more: http://ow.ly/JpEF302Cnzb

[radwareblog-blog]

2016 Summer Olympics: In The Crosshairs

by Daniel Smith

As the 2016 Summer Olympics approach, the cyber community turns its attention to the crowds and target-rich environment created by this high profile sporting event. Over 500,000 attendees to Rio De Janeiro are expected to consume record breaking connectivity volumes. This enormous demand will pose a security challenge for service providers as the 2016 Summer Olympics have the potential to be one of the most vulnerable sporting events in modern history and will provide cyber criminals with numerous opportunities.

Cyber criminals focus on identity theft by deploying malicious software designed to harvest and steal personal information. Technologies designed to enhance the spectator experience also poses challenges. Internet Service Providers (ISP), sponsors, online merchandise stores, gambling websites, hotels, and even federal and city administration networks are potential targets. Each has a different threat scenario based on the vector of attack.

Read more: http://ow.ly/CulA302qlIk