This month we are publishing a blog from cloud security partner, Zenedge. Here, we explore the evolution of the security threat landscape, from threat actors improving their hacking techniques to the increasingly daunting task of protecting public-facing web applications and API endpoints. Not only do organizations need to get to grips with reality and understand they are under attack nearly 100 percent of the time, they must also come to terms with the fact that their current approach to defending their applications and APIs is woefully deficient. However, there are solutions available now that can dramatically improve defensive postures to defeat today’s hacker campaigns and their ever-increasing persistence.
In the past, standard rule-based web application firewalls (WAFs) were highly recommended by industry experts and were even required by standards like PCI DSS. Understanding that no other technology was specifically designed to protect web applications, WAF technology successfully penetrated nearly every industry. Today’s surveys suggest that up to 80 percent of enterprises currently utilize some sort of WAF technology, primarily driven by compliance and other mandates. But are stand-alone WAFs enough to combat the increasing cyber attacks targeting web applications and APIs?
According to Dale Gardner, who is a Research Director with analyst firm Gartner, the Web Application Firewall market is ripe for disruption in 2018. Gardner has observed that the challenges current WAF vendors face are brought on by a very demanding market, by their slowness to offer easily-implemented protections, and to broadly address an ever-changing threat landscape.
In addition, organizations no longer want to deploy hardware WAFs, as they move more-and-more of their applications to the cloud. Organizations are looking for bundles of protection beyond just standard WAF rulesets. And finally, organizations want more automated tuning approaches, which may include capitalizing on new machine learning and artificial intelligence (AI) driven solutions. Surely the market is ripe for change.
Going beyond predicting a major market shift, Gardner also mentions new drivers that will allow innovative application security entrants (vendors) who offer cloud-based bundles of services to push change in the industry. From L3, L4, and L7 DDoS defenses, bot mitigation, AI-enabled WAFs, and API endpoint protection to content delivery, load balancing, and even acceleration, customers are demanding more to improve their site performance and thoroughly manage their cyber risk. The traditional WAF incumbents will either need to majorly enhance their offerings or risk losing considerable market share.
Gardner’s research and perspective go even further with the emergence of a new, more bundled technology/solution category he’s calling “WAAP”. The services-based solution he envisions incorporates content distribution and acceleration, bot mitigation, API protection, DDoS defenses, and delivery controllers. The next generation of application and API protection solutions he predicts will, of course, include cloud-based WAF yet tremendously go beyond the protections that can be delivered by a WAF alone.
The rationale for Gardner’s predictions are easily understood by those who are tasked with protecting the confidentiality and integrity of their organization’s data, while also being tasked with ensuring networks, sites, and applications are always available. Hackers today understand the vulnerabilities with current stand-alone WAF solutions and also understand the multi-vendor, disparate solution approach that many organizations have been forced to accept since cohesively bundled suites of solutions were simply not available to those that needed them most. However, all that has changed.
“Organizations will recognize and move towards integrated cybersecurity solution suites that work in an integrated cohesive fashion, with a single platform to configure, manage, monitor, and maintain security postures, allowing organizations to have a unified, clear picture of their cybersecurity perimeters.”
In 2014, the founders of Zenedge had a vision for a single, cloud-based platform comprised of a suite of solutions to directly address the future needs of organizations. This vision has come to fruition and today a unified suite of solutions is available to organizations that realize stand-alone WAFs are not enough in 2018 and beyond. Dale Gardner has ostensibly validated the Zenedge approach.
If you are interested in learning more about how you can develop your current WAF strategy then please get in touch. Our solutions offer a multi-tenant hosted platform with globally distributed POPs and geographically dispersed DDoS mitigation centers, coupled with security operation centers monitoring and mitigating network, application, and API attacks – 24×7. At the core of the offering is proprietary machine learning algorithms, coupled with threat intelligence and big data analysis.
This article was originally published on the Zenedge blog, authored by Stephen Gates, on Jan 3, 2018.
