Study of 10 million web application attacks shows automated attacks can peak at 25,000 an hour

Redwood Shores, Calif.  – Imperva, the data security leader, released today the results of the Imperva 2011 Web Application Attack Report (WAAR), which revealed that web applications, on average, experience twenty seven attacks per hour, or roughly one attack every two minutes. The WAAR, created as a part of Imperva’s ongoing Hacker Intelligence Initiative, offers insight into actual malicious web application attack traffic over a period of six months, December 2010 through May 2011.

Imperva monitored and categorized more than 10 million individual attacks across the internet, including attacks witnessed via onion router (TOR) traffic as well as attacks targeting 30 different enterprise and government web applications. The WAAR outlines the frequency, type and geography of origin of each attack to help security professionals better prioritize vulnerability remediation.

“Most security research focuses on vulnerabilities, and while this insight is extremely valuable, it doesn’t always help businesses prioritize their security efforts,” said Amichai Shulman, lead researcher and Imperva CTO. “Take a look at the OWASP Top 10, for example, RFI and Directory Traversal were not identified as top vulnerabilities, yet our research shows that these are two of the most common attacks used by hackers to steal data. It’s impossible to have effective risk management without understanding which vulnerabilities are most likely to be exploited.”

News Highlights

·         Automated attacks are prevailing. According to the WAAR, attack traffic during the six month period was characterized by spikes of high volume attack activity followed longer periods of lighter activity, key indicators of automation. On average companies experienced twenty-seven attacks per hour, or an attack every two minutes. However, when websites came under automated attack they received up to 25,000 attacks in one hour, or 7 attacks every second.

·         The Unfab Four. The four most prevalent Web application attacks include directory traversal (37 percent), cross site scripting (36 percent), SQL injection (23 percent) and remote file include (four percent). These attacks were often used in combination to scan for vulnerabilities and subsequently exploit found vulnerabilities.

·         Most attacks come from within the United States. Over 61 percent of the attacks originated from bots in the United States, though it was unclear from where they were controlled. Attacks from China made up almost 10 percent of attack traffic, followed by attacks originating in Sweden and France. Geography, however, is less than reliable, but filtering attacks by reputation is more so. The WAAR data shows that 29 percent of the attacks originated from the same 10 most active attack sources.

“The level of automation in cyber attacks continues to shock us. The sheer volume of attacks that can be carried out in such a short period of time is almost unimaginable to most businesses,” said Shulman. “The way hackers have leveraged automation is one of the most significant innovations in criminal history. You can’t automate car theft, or purse stealing. But you can automate data theft. Automation will be the driver that makes cyber crime exceed physical crime in terms of financial impact.”

“Advances in evasion are also significant. Our data shows that it is increasingly difficult to trace attacks to specific entities or organizations,” continued Shulman. “This complicates any effort to retaliate, shut down cybercriminal gangs or identify potential acts of war.”

CEO Checklist

1. Assume your organization is a target and have already been compromised. Consider yourself an even more attractive target if you hold sensitive information with value for hackers, governments, employees or competitors.

2. Make data security a strategic priority.

3. Give security a seat at the table, some firms have security reporting to the CEO or the board of directors others have put cyber security in into every technology decision and reversed conventional wisdom by having IT report into security, instead of vice versa.

4. Work with law enforcement to help pinpoint hackers, even overseas, to ensure that the weeds don’t grow back. What may seem like a minor cyber attack could be part of a larger criminal effort that only law enforcement can recognize.

5. Embrace data security regulations. For example A Ponemon survey on the topic from 2011 showed that companies complying with PCI were twice as likely to avoid breaches as noncompliant firms.

6. Put the right technology in place, the CEO should ask - have we identified all sensitive data and have put in place technology with the audit and protection capabilities required to safeguard that data?

Technical Recommendations

Automated attack detection requires collecting data, combining it and then analyzing it automatically in order to extract relevant information and apply security countermeasures. Gathering the required data requires monitoring protocol anomalies even if they are not malicious or if the web application is not vulnerable. Combining this data with intelligence gathered on known malicious sources will help enlarge the knowledge base for identifying attacks and selecting appropriate attack mitigation tools. Here are Imperva’s top 5 tips for the security team:

1. Deploy security solutions that deter automated attacks.

2. Detect known vulnerabilities attacks - the security organization needs to be aware of known vulnerabilities and have an up-to-date list to know what can and will be exploited by attackers.

3. Acquire intelligence on malicious sources and apply it in real time

4. Participate in a security community and share data on attacks.

5. Detect automated attacks early - quickly identifying thousands of individual attacks as one attack allows you to prioritize your resources more efficiently and can help in the detection of previously unknown attack vectors (e.g., “zero days”) included in the attack.

Online Resources

·         Download a full copy of Imperva’s 2011 Web Application Attack Report.

·         Read the blog for more insights from the Application Defense Center research lab.

·         Participate in a webinar about the findings on September 14.

About Imperva

Imperva is a pioneer and leader of a new category of data security solutions for high-value business data in the data center. With more than 1,300 end-user customers and thousands of organizations protected through cloud-based deployments, Imperva's customers include leading enterprises, government organizations, and managed service providers who rely on Imperva to prevent sensitive data theft from hackers and insiders. The award-winning Imperva SecureSphere identifies and secures high-value data across file systems, web applications and databases. For more information, visit www.imperva.com, follow us on Twitter or visit our blog.