Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Indusface

Penetration Testing: A Complete Guide

Penetration testing is a pre-defined set of procedures used to identify any unknown weakness in the IT infrastructure of a business. It involves attempts to exploit vulnerabilities, which may exist in services and application flaws, operating systems, risky end-user behaviour, or improper configurations, to validate the efficacy of protection mechanisms and end-user observation of security policies.

Top F5 WAF Alternatives in 2023

F5 Cloud WAF combines signature and behaviour-based threat detection mechanisms to protect applications, regardless of the deployment location. It protects against injection attacks, session hijacking, cross-site scripting, man-in-the-middle attacks, and numerous other vulnerabilities, with continuously updated policies to shield against emerging threats.

Security Incident Management, Data Protection & Privacy Best Practices | Edgar P. (Group CISO @ YNV)

In this SaaSTrana podcast, Edgar Pimenta (Group CISO @ YNV Group) talks to Venky about the security incident management and data protection/privacy management best practices in highly regulated organizations such as telcos and financial. He also shares the steps on how orgnizations can prepare themselves in case of an incident breach and ways to recover from it quickly. Here are some key highlights from the discussion.

HTTP/2 Rapid Reset Attack Vulnerability

Google, Amazon Web Services & others recently disclosed a vulnerability in HTTP/2 protocol, which is being tracked as “CVE-2023-44487”. The flaw lies in how the HTTP/2 protocol was implemented to increase the efficiency of transmitting various messages between endpoints by “Stream multiplexing”.

Cloudflare vs. Azure WAF

Cloudflare WAF protects against web-based attacks and malicious traffic using customizable rule sets. Cloudflare’s network extends across numerous data centers worldwide, ensuring efficient content delivery and robust DDoS protection. Moreover, Cloudflare provides supplementary functionalities such as CDN caching, SSL/TLS encryption, and DNS management to enhance overall web performance and security.

Live DDoS Attack Simulation on Websites & APIs

DDoS attacks have increased by 75% in Q2 when compared to Q1, 2023 as per Indusface research – State of Application Security. Launching a 1-hour DDoS attack costs only a couple of bucks on the dark web. So, how does one fortify defenses to ensure app and API availability in case of an attack? In this live attack simulation, Karthik Krishnamoorthy (CTO - Indusface) demonstrates a wide variety of attacks and mitigation measures.

Building North Star Metrics for Security Teams | Mona Salvi (Senior Director, HubSpot)

Here are some highlights of the conversation between Mona Salvi (Senior Director - Product Security, HubSpot) and Venky (Founder, Indusface). She talks to Venky about building a unified organization structure and North Star metrics to drive security-related initiatives in a cohesive working environment. She also shares how to manage three pillars - platform security + trust & safety + payments fraud together under a single leadership umbrella.

Protecting from Threats Caused by OpenAI and LLM Tools | Mona Salvi (Senior Director, HubSpot)

Here are some highlights of the conversation between Mona Salvi (Senior Director - Product Security, HubSpot) and Venky (Founder, Indusface). She talks to Venky about building a unified organization structure and North Star metrics to drive security-related initiatives in a cohesive working environment. She also shares how to manage three pillars - platform security + trust & safety + payments fraud together under a single leadership umbrella.

What is an Authenticated Security Scan, And Why Is It Important?

Many organizations today rely only on “unauthenticated” web application security scans, leaving their admin and user portals unchecked. While it is crucial to protect your system against external automated attacks, you shouldn’t ignore the possibility of a targeted attack from someone with valid logins. If your app lets anyone signup online, it could easily expose your business to attackers.