CLOUDTWEAKS CONTRIBUTOR PROGRAM

Join the CloudTweaks thought leadership contributor program which includes a customized profile, branded identity page, newsletter marketing, social amplification and more...

The program is currently available to consultants, influencers or executive level contributors.

shira

Protecting Your Web Applications In A Hybrid Cloud Environment

Protecting Your Web Applications

It’s no secret that organizations are embracing the cloud and all the benefits that it entails. Whether its cost savings, increased flexibility or enhanced productivity – businesses around the world are leveraging the cloud to scale their business and better serve their customers. They are using a variety of cloud solutions – both private and public – and relying on multiple cloud hosting vendors to facilitate this growth. But as the saying goes – there is no such thing as free lunch. A hybrid cloud environment leads to an overall loss of control and visibility into the network, and in turn, can bring a host of security challenges.

Disappearing Network Perimeter

cloudy

As more services and applications are moved outside the enterprise perimeter and onto the cloud, the traditional network perimeter is going away. The hosting of applications is often distributed, and while some applications are being migrated to the cloud, others are still in transition or may remain on-premise. Organizations are now faced with the need to protect their applications everywhere – on-premise and in the cloud.

This leaves the door open for attackers. They now have a new target and instead of targeting just the on-premise applications, they are going after applications in the cloud. Organizations that rely solely on on-premise attack mitigation are leaving their cloud-based applications vulnerable to attacks.

Increased Dependency on Multiple Vendors

Most companies use multiple cloud vendors for hosting various aspects of their infrastructure. Some organizations choose to deploy a multi-cloud strategy for redundancy – to limit risk of downtime in case of failures and also reduce the risk posed by relying on a single vendor. In other cases, applications that have different needs in terms of bandwidth and availability are hosted on different cloud services to fit their specific needs. In addition, a multi-cloud strategy can be used to provide geographically diverse service across multiple cloud centers.

The use of a multi-vendor cloud hosting strategy complicates the ability to protect applications. It introduces dependency on the security solutions provided by each cloud vendor, which can offer varying degrees of protection. Overall this further limits the control and visibility of the organization’s infrastructure, making it harder to protect and manage multiple instances.

Rise in Popularity of Web Based Attacks

In today’s evolving threat landscape, the task of ensuring application availability is becoming more complex. As attacks are getting longer, larger and more sophisticated, organizations need to be able to protect their applications from a large variety of security threats, including:

  • Web-based attacks mostly known through the Open Web Application Security Project (OWASP) Top 10, which lists out the most common web-based threats. This category includes threats such as SQL Injections, Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF), which are typically not covered by traditional firewalls and intrusion detection systems (IDS). There is also a host of web-based attacks beyond the OWASP Top 10, such as Brute Force attacks, that should also be considered when looking at application security.
  • Availability based attacks – Distributed Denial of Service (DDoS) attacks at both the network and application layers. This includes the use of automated programs (bots) as well as humans to launch attacks aimed at exhausting application resources.
  • Multi-vector attacks – Sophisticated attacks that leverage multiple attack vectors are a common form of attack today. Rarely do we see attacks that only use one single vector. To deal with multi-vector attacks, organizations need a layered protection solution that can detect and mitigation attacks at all layers of the network.

Organizations’ New Requirements

Overall, organizations are facing several new challenges that lead to greater value requirements from security solutions, such as:

Protecting applications in a dynamic and moving environment. Organizations are faced with a distributed network and disaggregated applications. As such, they need a solution that can provide protections to applications regardless of where they are located. A hybrid solution is the best approach to provide comprehensive protection for applications – both on-premise and in the cloud – and can work across multiple cloud vendors. It removes the dependencies on different third parties and consolidates the protection of applications in a single-vendor, single-technology solution.
Wide protection coverage that covers the full range of attacks from network- and application layer DDoS attacks (including volumetric attacks), to more common web-based attacks (SQL Injections, XXS), all the way to the more advanced web attacks (Cookie Poisoning, XML and web services attacks). With the popularity of multi-vector attacks, having wide protection coverage is critical to eliminate any blind spots in the network that an attacker can leverage.

Ease of use and serviceability must be established to lift the burden off the IT and Security teams in the organization. Setting up and configuring some solutions requires a lot of manual work and ongoing maintenance. It’s important to pick a solution that is both easy to set-up and easy to maintain. A fully managed cloud service that includes 24/7 support and monitoring as well as ongoing reports can help provide that.

With the enterprise perimeter disappearing and the increase in third party security dependencies, coupled with the rise in more sophisticated, multi-vector attack campaigns, organizations need to carefully examine the security solutions available to them and make sure they address these new challenges.

By Shira Sagiv, Director of Security Solutions, Radware

Radware is a global leader of application delivery and application security solutions for virtual, cloud and software defined data centers. Its award-winning solutions portfolio delivers service level assurance for business-critical applications, while maximizing IT efficiency.

CloudTweaks

Established in 2009, CloudTweaks is recognized as one of the leading authorities in cloud connected technology information, resources and thought leadership services.

Contact us for a list of our leading brand and thought leadership exposure programs.

The Lighter Side Of The Cloud - Cloud Holiday
The Lighter Side Of The Cloud - Thunderstorms
The Lighter Side Of The Cloud - Uh-Oh!
The Lighter Side Of The Cloud - Underground
The Lighter Side Of The Cloud - Drop Zone
GDPR Compliance: A Network Perspective

GDPR Compliance: A Network Perspective

GDPR Compliance Regulations can be a tricky thing. For the most part, they’re well thought out in terms of mandating ...
The Cloud Debate - Private, Public, Hybrid or Multi Clouds?

The Cloud Debate – Private, Public, Hybrid or Multi Clouds?

The Cloud Debate Now that we've gotten over the hump of whether we should adopt the cloud or not, "which ...
Multi or Hybrid Cloud, What’s the Difference?

Multi or Hybrid Cloud, What’s the Difference?

Multi Cloud You’ve likely heard about the latest trend in cloud computing commonly referred to as multi-cloud, and it is ...
How prepared are you to overcome the misuse of AI

How prepared are you to overcome the misuse of AI

Overcome the Misuse of AI Have you ever considered that the AI system integrated into your organisation's computing infrastructure could ...
Critical Success Factors when shifting Workloads into the Cloud

Critical Success Factors when shifting Workloads into the Cloud

Shifting Workloads into the Cloud By 2020, 92 percent of all workloads will reside in the cloud. Yet challenges remain ...
Cloud Communications Security: Whose Business Is It, Anyway?

Cloud Communications Security: Whose Business Is It, Anyway?

Cloud Communications Security Don’t count on cloud providers to provide all your UCaaS security It’s official: Unified Communications-as-a-Service (UCaaS) has ...
Combatting Malware in the Cloud Requires a New Way of Thinking

Combatting Malware in the Cloud Requires a New Way of Thinking

Malware in the Cloud It’s no secret that cloud adoption has exploded in the enterprise over last few years. However, ...
Key Findings of the 2018 IDG Cloud Computing Study

Key Findings of the 2018 IDG Cloud Computing Study

IDG Cloud Computing Study The results of the 2018 IDG Cloud Computing study highlight how interest in the technology isn’t fading and a growing number of companies are embracing it or at least want to do so. The survey, which ...
Glassdoor’s 10 Highest Paying Tech Jobs Of 2018

Glassdoor’s 10 Highest Paying Tech Jobs Of 2018

Glassdoor is best known for its candid, honest reviews of employers written anonymously by employees. It is now common practice and a good idea for anyone considering a position with a new employer to check them out on Glassdoor first. With ...
8 Cloud Characteristics Every ERP System Needs

8 Cloud Characteristics Every ERP System Needs

ERP System Cloud-based ERP systems offer many benefits to a growing organization. And those benefits are catching on in a big way in recent years. In fact, according to the RightScale State of the Cloud 2016 Survey, which has collected ...
real time hacking attacks

Live Real Time Hacking and Ransomware Tracking Maps Online

Real Time Hacking Attacks We've recently covered a few real time hacking maps but have decided to extend the list based on the recent ransomware activities with some additional real time hacking attack and ransomware tracking maps. Ransomware refers to malicious ...
How Security Certification Helps Cloud Service Providers Stay Transparent and Credible

How Security Certification Helps Cloud Service Providers Stay Transparent and Credible

Security Certification Helps Cloud Service Providers If you are a cloud service provider (CSP), you know your customers have a choice as to who to work with, but do you know what will help tip the scales in your favor? ...
Free Report: "Gartner Report: 2018 CEO Survey"

Free Report: “Gartner Report: 2018 CEO Survey”

Deep discipline is required for digital business. Read the full report to learn how to: Prepare for more deeply disciplined exploitation of the digital business changes ahead, Lock the leadership into winning through digital business, Drive business model changes and ...