We previously reported that the overall number of new web application vulnerabilities in 2017 showed a 212% increase from 2016’s 6,615 to a whopping 14,082. This spike was due, in part, to high-profile vulnerabilities like Heartbleed, Shellshock, POODLE, Apache Struts 2 and more recently, Meltdown and Spectra.
There is, however, good news in the form of a new tool tasked with pushing mitigations for high-profile vulnerabilities like these to the SecureSphere Web Application Firewall (WAF) within a matter of hours.
Ongoing Vulnerability Protection
Tasking your security team with analyzing each and every vulnerability, deciding their relevance and applying the necessary mitigations is near impossible, which is why virtual patching of your WAF is so important. Not updating your WAF regularly is like wearing your old 80s jeans thinking you’re still cool…you’re not. Imperva regularly releases mitigations for new vulnerabilities.
In today’s tech landscape, where constantly up-leveled cyberattacks are one of the most prominent threats to corporate assets, timing is everything.
Once a vulnerability is published it’s only a matter of time until attackers will exploit it. It only takes a few hours for high-quality code snippets to be published and by then, every script-kiddy has had the opportunity to run them against whomever they choose. In the case of a 2017 Apache Struts vulnerability, for example, an official exploit was made public one day after the vulnerability was announced. Clearly, updating mitigations only once every few weeks is not enough.
The Answer: An Emergency Feed
Imperva has incorporated an emergency feed into our ThreatRadar subscription service as an extension of our WAF, which allows Imperva security researchers to push mitigations for high-profile vulnerabilities to the WAF in just a matter of hours. Our goal is to push mitigations via the emergency feed in no less than 24 hours from the time of the vulnerability’s publication, so whether a new vulnerability hits the landscape in the middle of the night or your entire security team is on vacation, your WAF estate is protected.
So, how do we do it?
To apply mitigation through the emergency feed, a vulnerability must be remotely exploited, operational without authentication and have the potential to be highly impactful. In these cases, Imperva researchers analyze the vulnerability, understand its scope, and create the appropriate mitigation. The mitigation is then run through a wide set of Incapsula and SecureSphere customers, on real-world data, to observe its false positive rate and search for the vulnerabilities’ variations. Only when our researchers are convinced that the new mitigation is stable and reliable will they push it into the emergency feed.
Simply put, in just a few hours, all of Imperva’s customers on Incapsula and SecureSphere WAFs are fully protected. The best part? There’s no action required by your in-house security team. As soon as they’re back in the office they have access to a report summarizing the nature of the vulnerability and the mitigation applied.
Included with ThreatRadar Subscription
If you’re a SecureSphere customer with a ThreatRadar subscription, the emergency feed is included and takes only a few clicks to enable. Incapsula customers receive this service out of the box – no registration required.
For SecureSphere customers with ThreatRadar subscription:
- Check the Emergency Feed box on the customer portal to register.
- In the Imperva SecureSphere WAF dashboard, enable the Emergency Feed services under the ThreatRadar tab.
That’s it. The emergency feed is enabled and will begin receiving new mitigations immediately. With each content update, our researchers will remove the most recent mitigations from the emergency feed and permanently add them to your SecureSphere WAF, so your system is updated. You will be notified of updates via email.
Try Imperva for Free
Protect your business for 30 days on Imperva.
