Click here to close now.




















Welcome!

Wearables Authors: Pat Romanski, Mike Kavis, Tim Hinds, Liz McMillan, Kevin Benedict

News Feed Item

Radware Releases Global Security Report - Reveals New Cyber Attack Methods Uncovering Blind-Spots Unrecognized by Security Professionals and Organizations

Server-based botnets and HTTPS layer attacks among the tactics leveraged by hackers in some of 2012's most notorious attacks

MAHWAH, New Jersey, January 22, 2013 /PRNewswire/ --

In the face of an ever-evolving cyber security landscape, researchers at Radware® (NASDAQ: RDWR), a leading provider of application delivery and application security solutions for virtual and cloud data centers, have identified a number of new attack methods representative of today's increasingly sophisticated and severe distributed-denial-of-service (DDoS) threat. Radware's 2012 Global Application and Network Security Report highlights server-based botnets and encrypted layer attacks as just two of the new attack tools challenging organizations during DDoS attacks. Most recently, these tactics were leveraged by perpetrators in the attacks against U.S. financial institutions that have been ongoing since September 2012.

Prepared by Radware's Emergency Response Team (ERT) which actively monitors and mitigates attacks in real-time, the in-depth research report also found that while security organizations have focused their efforts and attention on the pre and post-phases of defense, attackers now launch prolonged attacks that last days or weeks. This has created a vulnerable blind-spot as defenders lack the capabilities and resources to mitigate attacks in the "during" phase which attackers can exploit to their advantage.  

"The Radware ERT sees hundreds of DoS/DDoS attacks each year, and we've found attacks lasting more than one week have doubled in frequency during 2012," says Avi Chesla, chief technology officer at Radware. Through empirical and statistical research coupled with front-line experience, our team identified trends that can help educate the security community.

"Through highlighting significant trends found in this report, our goal is to provide actionable intelligence to ensure organizations can better detect and mitigate these threats that plague their network infrastructure," adds Chesla.

Key findings from the report include:

  • Server-based botnets represent a new and more powerful order in the DDoS environment. The shift from single-server attacks to the use of multiple servers in different geographic locations has allowed attackers to quickly and effectively launch more powerful DDoS attacks than ever before. Just a few attacking servers can produce the same attack traffic as a large number of client botnets, with the 24/7 availability of servers allowing for greater reliability as well as command-and-control. In 2013, Radware expects this method to gain in popularity, requiring that organizations make sure their defense architecture can withstand these scaled up attacks. Although effective, several weak points are uncovered and identified. 
  • The number of DDoS and DoS attacks lasting more than one week doubled  in 2012. Radware's ERT developed the Advanced Persistent Threat (APT) score to quantify and qualify the increasing force, sophistical and persistence of 2012's attacks. The numbers are staggering - with 58 percent of attacks scoring a 7 or higher in complexity (out of 10), as compared to just 23 percent of attacks in 2011. In 2011, only 30% of attacks scored higher than a level of 3 in terms of severity, while in 2012 70% achieved a level of 3 or higher.
  • Encrypted layer attacks fly below the radar - and can't be ignored. In 2012, the growing popularity of HTTPS-based attacks added a new dimension to the security landscape. Though conventionally associated with security on the web, hackers have managed to weaponize the encryption layer, using it to launch application-level and SSL attacks that can escape detection and remain hidden until its already too late. This has become an especially troubling phenomenon for financial services and e-commerce websites that rely heavily on HTTPS.
  • In today's security environment, most organizations are bringing a knife to a gunfight. With some of the worlds largest institutions victimized by cyber attacks in 2012, the question remains as to why many of these organizations continue to be vulnerable. The fact remains that less than a quarter of all organizations surveyed invest their efforts in mitigating attacks as they're happening - a fact exploited by hackers. In 2013, Radware recommends that organizations dedicate resources to creating a "security war room" equipped to dynamically respond to and handle persistent security attacks during all phases of an attack and adopt a three-phased security approach.
  • The 'DIY' phenomenon.  The proliferation of 'do-it-yourself' sites devoted to enabling hacking schemes has reached commodity market proportions. The supply chain includes took kits and for-hire services that are available to anyone with minimal coding or advanced hacking skills for as little as $10 for a ransomware attack tool.  This has significantly reduced the barrier of entry for individuals or organizations to launch an attack.  

The report which doubles as a resource guide that security professionals can easily reference also features recommendations that organizations can adopt to safeguard themselves against emerging attack trends and techniques. Chief among these recommendations are:

  • How to Stop Sophisticated Attack Campaigns.  Organizations usually administer a two-phase "pre and post" attack security approach as their defense strategy. Sophisticated campaigns can only be eradicated by setting a third-phase security approach during the attack. A cadre of external "on-demand" force multiplier teams who can dynamically respond and employ tactics to mitigate future attacks needs to be implemented by an organization. A typical, persistent DDoS attack requires no less than 9 security engineers  for sufficient defense.    
  • Examination Lines of Defense. Mitigation may have improved, but this has also pushed attackers to invest in finding the weak links in lines of defense. Organizations should ensure that their line of defense is comprehensive. As part of this, a mitigation checklist must be completed, with any missing elements in to be addressed.
  • Carefully Consider Network Architecture. To be effective, a DoS / DDoS mitigation solution must be placed before most of the network elements in the path, which is not the traditional deployment. Additionally, if a content delivery network (CDN) is the primary DDoS mitigation solution, ensure you complement it with a customer premise equipment (CPE) solution for optimal protection.

To download the complete 2012 Global Network & Application Security Report, which includes the ERT's recommendations for how organizations can best prepare for mitigating cyber threats in 2013, please visit http://www.radware.com/globalsecurityreport

Additional Resources

ERT Video: Matthew Andriani, ERT Specialist discusses APT Scoring (http://youtu.be/L8tfWlPbRzg)

ERT Video: Ziv Gadot, ERT Team Leader discusses how to stop sophisticated attack campaigns (http://youtu.be/y0i5yQ_rJUY)

Slideshare Presentation: http://www.slideshare.net/Radware/2012-global-application-and

Blog: http://blog.radware.com/security/

About the Radware Emergency Response Team (ERT)

Radware's ERT is a group of dedicated security consultants who are available around the clock.  As literal "first responders" to cyber attacks, Radware's ERT members gained their extensive experience by successfully dealing with some of the industry's most notable hacking episodes, providing the knowledge and expertise to mitigate the kind of attack a business's security team may never have handled.  Through the report, the ERT reveals how their in-the-trenches experiences fighting cyber attacks provide deeper forensic analysis than surveys alone or academic research.

About the 2012 Global Network & Application Security Report

Radware's annual Global Application & Network Security Report provides insight into network security trends with a specific focus on DoS/DDoS attacks.  Intended for the entire security community, this research is designed to deliver a comprehensive and objective summary of network security events and DoS / DDoS attacks that took place in 2012, with an analysis of attack types, trends and mitigation technologies.  Altogether, the report draws its information from 274 organizations from two sources: Radware's Industry Security Review and key security cases from Radware's Emergency Response Team.

About Radware

Radware (NASDAQ: RDWR), is a global leader of application delivery and application security solutions for virtual and cloud data centers. Its award-winning solutions portfolio delivers full resilience for business-critical applications, maximum IT efficiency, and complete business agility.

Radware's solutions empower more than 10,000 enterprise and carrier customers worldwide to adapt to market challenges quickly, maintain business continuity and achieve maximum productivity while keeping costs down.  For more information, please visit http://www.radware.com.

Radware encourages you to join our community and follow us on; LinkedIn, Radware Blog, Twitter, YouTube, Radware Connect app for iPhone® and our new security center DDoSWarriors.com that provides a comprehensive analysis on DDoS attack tools, trends and threats.

©2013 Radware, Ltd. All rights reserved. Radware and all other Radware product and service names are registered trademarks or trademarks of Radware in the U.S. and other countries. All other trademarks and names are property of their respective owners.

This press release may contain statements concerning Radware's future prospects that are "forward-looking statements" under the Private Securities Litigation Reform Act of 1995. Statements preceded by, followed by, or that otherwise include the words "believes", "expects", "anticipates", "intends", "estimates", "plans", and similar expressions or future or conditional verbs such as "will", "should", "would", "may" and "could" are generally forward-looking in nature and not historical facts. These statements are based on current expectations and projections that involve a number of risks and uncertainties.  There can be no assurance that future results will be achieved, and actual results could differ materially from forecasts and estimates.  These risks and uncertainties, as well as others, are discussed in greater detail in Radware's Annual Report on Form 20-F and Radware's other filings with the Securities and Exchange Commission.  Forward-looking statements speak only as of the date on which they are made and Radware undertakes no commitment to revise or update any forward-looking statement in order to reflect events or circumstances after the date any such statement is made.  Radware's public filings are available from the Securities and Exchange Commission's website at http://www.sec.gov  or may be obtained on Radware's website at http://www.radware.com.

Corporate Media Relations:

Brian T. Gallagher
+1-201-785-3206  (office)
+1-201-574-3840  (cell)
[email protected]

SOURCE Radware Ltd

More Stories By PR Newswire

Copyright © 2007 PR Newswire. All rights reserved. Republication or redistribution of PRNewswire content is expressly prohibited without the prior written consent of PRNewswire. PRNewswire shall not be liable for any errors or delays in the content, or for any actions taken in reliance thereon.

@ThingsExpo Stories
Through WebRTC, audio and video communications are being embedded more easily than ever into applications, helping carriers, enterprises and independent software vendors deliver greater functionality to their end users. With today’s business world increasingly focused on outcomes, users’ growing calls for ease of use, and businesses craving smarter, tighter integration, what’s the next step in delivering a richer, more immersive experience? That richer, more fully integrated experience comes about through a Communications Platform as a Service which allows for messaging, screen sharing, video...
Too often with compelling new technologies market participants become overly enamored with that attractiveness of the technology and neglect underlying business drivers. This tendency, what some call the “newest shiny object syndrome,” is understandable given that virtually all of us are heavily engaged in technology. But it is also mistaken. Without concrete business cases driving its deployment, IoT, like many other technologies before it, will fade into obscurity.
SYS-CON Events announced today that IceWarp will exhibit at the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. IceWarp, the leader of cloud and on-premise messaging, delivers secured email, chat, documents, conferencing and collaboration to today's mobile workforce, all in one unified interface
In his session at @ThingsExpo, Lee Williams, a producer of the first smartphones and tablets, will talk about how he is now applying his experience in mobile technology to the design and development of the next generation of Environmental and Sustainability Services at ETwater. He will explain how M2M controllers work through wirelessly connected remote controls; and specifically delve into a retrofit option that reverse-engineers control codes of existing conventional controller systems so they don't have to be replaced and are instantly converted to become smart, connected devices.
The Internet of Things is in the early stages of mainstream deployment but it promises to unlock value and rapidly transform how organizations manage, operationalize, and monetize their assets. IoT is a complex structure of hardware, sensors, applications, analytics and devices that need to be able to communicate geographically and across all functions. Once the data is collected from numerous endpoints, the challenge then becomes converting it into actionable insight.
With the proliferation of connected devices underpinning new Internet of Things systems, Brandon Schulz, Director of Luxoft IoT – Retail, will be looking at the transformation of the retail customer experience in brick and mortar stores in his session at @ThingsExpo. Questions he will address include: Will beacons drop to the wayside like QR codes, or be a proximity-based profit driver? How will the customer experience change in stores of all types when everything can be instrumented and analyzed? As an area of investment, how might a retail company move towards an innovation methodolo...
SYS-CON Events announced today that HPM Networks will exhibit at the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. For 20 years, HPM Networks has been integrating technology solutions that solve complex business challenges. HPM Networks has designed solutions for both SMB and enterprise customers throughout the San Francisco Bay Area.
Consumer IoT applications provide data about the user that just doesn’t exist in traditional PC or mobile web applications. This rich data, or “context,” enables the highly personalized consumer experiences that characterize many consumer IoT apps. This same data is also providing brands with unprecedented insight into how their connected products are being used, while, at the same time, powering highly targeted engagement and marketing opportunities. In his session at @ThingsExpo, Nathan Treloar, President and COO of Bebaio, will explore examples of brands transforming their businesses by t...
SYS-CON Events announced today that Pythian, a global IT services company specializing in helping companies leverage disruptive technologies to optimize revenue-generating systems, has been named “Bronze Sponsor” of SYS-CON's 17th Cloud Expo, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. Founded in 1997, Pythian is a global IT services company that helps companies compete by adopting disruptive technologies such as cloud, Big Data, advanced analytics, and DevOps to advance innovation and increase agility. Specializing in designing, imple...
As more and more data is generated from a variety of connected devices, the need to get insights from this data and predict future behavior and trends is increasingly essential for businesses. Real-time stream processing is needed in a variety of different industries such as Manufacturing, Oil and Gas, Automobile, Finance, Online Retail, Smart Grids, and Healthcare. Azure Stream Analytics is a fully managed distributed stream computation service that provides low latency, scalable processing of streaming data in the cloud with an enterprise grade SLA. It features built-in integration with Azur...
SYS-CON Events announced today that Micron Technology, Inc., a global leader in advanced semiconductor systems, will exhibit at the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. Micron’s broad portfolio of high-performance memory technologies – including DRAM, NAND and NOR Flash – is the basis for solid state drives, modules, multichip packages and other system solutions. Backed by more than 35 years of technology leadership, Micron's memory solutions enable the world's most innovative computing, consumer,...
Contrary to mainstream media attention, the multiple possibilities of how consumer IoT will transform our everyday lives aren’t the only angle of this headline-gaining trend. There’s a huge opportunity for “industrial IoT” and “Smart Cities” to impact the world in the same capacity – especially during critical situations. For example, a community water dam that needs to release water can leverage embedded critical communications logic to alert the appropriate individuals, on the right device, as soon as they are needed to take action.
While many app developers are comfortable building apps for the smartphone, there is a whole new world out there. In his session at @ThingsExpo, Narayan Sainaney, Co-founder and CTO of Mojio, will discuss how the business case for connected car apps is growing and, with open platform companies having already done the heavy lifting, there really is no barrier to entry.
With the Apple Watch making its way onto wrists all over the world, it’s only a matter of time before it becomes a staple in the workplace. In fact, Forrester reported that 68 percent of technology and business decision-makers characterize wearables as a top priority for 2015. Recognizing their business value early on, FinancialForce.com was the first to bring ERP to wearables, helping streamline communication across front and back office functions. In his session at @ThingsExpo, Kevin Roberts, GM of Platform at FinancialForce.com, will discuss the value of business applications on wearable ...
As more intelligent IoT applications shift into gear, they’re merging into the ever-increasing traffic flow of the Internet. It won’t be long before we experience bottlenecks, as IoT traffic peaks during rush hours. Organizations that are unprepared will find themselves by the side of the road unable to cross back into the fast lane. As billions of new devices begin to communicate and exchange data – will your infrastructure be scalable enough to handle this new interconnected world?
WebRTC has had a real tough three or four years, and so have those working with it. Only a few short years ago, the development world were excited about WebRTC and proclaiming how awesome it was. You might have played with the technology a couple of years ago, only to find the extra infrastructure requirements were painful to implement and poorly documented. This probably left a bitter taste in your mouth, especially when things went wrong.
The Internet of Things (IoT) is about the digitization of physical assets including sensors, devices, machines, gateways, and the network. It creates possibilities for significant value creation and new revenue generating business models via data democratization and ubiquitous analytics across IoT networks. The explosion of data in all forms in IoT requires a more robust and broader lens in order to enable smarter timely actions and better outcomes. Business operations become the key driver of IoT applications and projects. Business operations, IT, and data scientists need advanced analytics t...
Akana has announced the availability of the new Akana Healthcare Solution. The API-driven solution helps healthcare organizations accelerate their transition to being secure, digitally interoperable businesses. It leverages the Health Level Seven International Fast Healthcare Interoperability Resources (HL7 FHIR) standard to enable broader business use of medical data. Akana developed the Healthcare Solution in response to healthcare businesses that want to increase electronic, multi-device access to health records while reducing operating costs and complying with government regulations.
For IoT to grow as quickly as analyst firms’ project, a lot is going to fall on developers to quickly bring applications to market. But the lack of a standard development platform threatens to slow growth and make application development more time consuming and costly, much like we’ve seen in the mobile space. In his session at @ThingsExpo, Mike Weiner, Product Manager of the Omega DevCloud with KORE Telematics Inc., discussed the evolving requirements for developers as IoT matures and conducted a live demonstration of how quickly application development can happen when the need to comply wit...
The Internet of Everything (IoE) brings together people, process, data and things to make networked connections more relevant and valuable than ever before – transforming information into knowledge and knowledge into wisdom. IoE creates new capabilities, richer experiences, and unprecedented opportunities to improve business and government operations, decision making and mission support capabilities.