Last year, Imperva embarked on a mission to help organizations combat the growing threat of digital fraud. We introduced a new solution and a range of innovative features to help detect and prevent online fraud at its earliest stages. Imperva Online Fraud Prevention stops fraud ranging from client-side attacks that exploit compromised JavaScript and steal sensitive data, to mitigating automated fraud that often uses that same stolen data, such as account takeover, fake account creation, transaction fraud, gift card fraud, and more. As online fraud continues to evolve, it remains a major concern for organizations. According to a report from the FBI, $10.3 billion was lost to online fraud in 2022 alone. But just as the threat keeps evolving, so are we. In this blog post, we will cover the latest set of features added to our market-leading Online Fraud Prevention solution.
Imperva Advanced Bot Protection – Integration with API Security
We are delighted to announce the first stage of integration between Imperva Online Fraud Prevention and Imperva API Security. This integration takes advantage of the Imperva Application Security Platform, combining our best-of-breed solutions to bring defense-in-depth to our customers. With this integration, we are making further investments in innovation around protecting APIs from automated fraud and business logic abuse. It builds upon the ability of Imperva Advanced Bot Protection to protect APIs against the most sophisticated automated threats while adding increased visibility, monitoring, and actionable insights for customers, powered by our API Security solution.
In this first stage of the integration, customers using both solutions will benefit from the following:
- In Imperva API Security: once a customer onboards, all of their APIs will be discovered and classified based on their sensitivity, the nature of data being transacted, the risks associated with the APIs, and the functionality of the APIs (e.g., Login, File Upload, etc.). Customers will have a single dashboard view that will provide visibility into whether an API is onboarded to Advanced Bot Protection. If it isn’t onboarded, the dashboard will provide this information and whether it should be added, based on risk level. Customers can also enable Advanced Bot Protection for high-risk APIs with a simple click of a button.
- In Imperva Advanced Bot Protection: under the new version of the ‘Policies’ page, customers will now have more visibility over the APIs that are sending sensitive data or have security issues (as classified by API Security), allowing them to prioritize which APIs to onboard to Advanced Bot Protection. For these APIs, customers will be notified that they can use Advanced Bot Protection to secure them against bots and automated fraud. Furthermore, customers will be able to assign policies, and therefore conditions and directives, within Advanced Bot Protection to protect their sensitive APIs. Specifically, customers will be able to view and add mitigation tactics for these at-risk APIs within the Advanced Bot Protection website groups tab.
The improved visibility, monitoring, and actionable insights offered with this integration will empower customers to mitigate any potentially fraudulent activity on their APIs. In contrast to other solutions which only protect APIs from automated threats, this integration allows for more granular customization with pinpoint accuracy.
Imperva Account Takeover Protection – Site-Profile-Based Detection
We are thrilled to introduce a brand new, innovative approach to account takeover detection. The Site-Profile-Based (SPB) Detection is a first-of-its-kind, patented technology that generates a unique profile for each website protected by Imperva Account Takeover Protection. The profile is a representation of how the site looks during normal traffic as well as how attack traffic looks. It is based on a proprietary set of granular details, features, and parameters that make up each site’s distinctive traffic, which together comprise its unique profile. Each site profile has a section where customers can see what ‘normal’ behavior looks like and compare it to ‘attack’ behavior, with each of these sections including the same set of statistics.
Imperva Account Takeover Protection then uses the site’s profile to analyze each login request, looking for anomalies. If a request is anomalous, it’s assigned a risk score and Imperva Account Takeover Protection automatically decides whether or not it should be mitigated based on the customer’s policies.
We have already seen SPB Detection mitigate highly sophisticated attacks and we are excited to be able to provide even stronger login protection for our customers and their clients, protecting them from account takeover and other forms of account-based fraud.
SPB Detection joins our industry-leading, multilayered approach to detection that brings together cutting-edge technology and human intelligence. All site profiles are generated based on historic login request data so that customers will be able to take advantage of the feature as soon as it’s available.
Imperva Account Takeover Protection – Visualizations for Login Behavior
Visualization helps people see, interact with, and better understand data. In this release, we are introducing a new way for customers to visualize their data within Imperva Account Takeover Protection in a more granular with new visualization options for login behavior. These new visualizations enable customers to view trends and statistics on login attempts over time for any of their onboarded websites. They can see the percentage of account takeover attempts compared to the total login attempts, for example, as well as examine and assess the impact of their existing mitigation strategy for malicious login attempts on their websites.
When navigating to any of the login data in Imperva Account Takeover Protection, the “Visualize” option enables customers to view a graphical representation of login attempts over time, according to the source’s IP address.
Customers now have a visual representation of their login data and login behavior on their websites. When hovering over a data point, the information provided can help them to see where attacks are heavily populated and where clusters may be originating from.
Beyond viewing their data in lists and tables, these visualizations provide customers with a better user experience that’s easier to digest and act upon. Visualizing the data can help security and fraud teams better detect, predict, and prevent account takeover and other types of account-based fraud. It’s a quicker way for them to analyze the data and pinpoint anomalous behavior.
Imperva Account Takeover Protection – Terraform Support
Terraform is an infrastructure-as-code (IaC) tool that enables users to build, change, and version cloud and on-premises resources safely and efficiently. With the added support for Terraform, we are taking yet another step towards automation. It will save customers time by enabling them to automate various processes and configurations within Account Takeover Protection. In addition, it will enable customers within certain industries that are required to use Terraform for compliance reasons to use Account Takeover Protection.
Imperva Account Takeover Protection – Added Support for HTTP Basic Authentication
Account Takeover Protection now supports the basic authentication method of HTTP authorization for users logging into a customer’s application. This provides customers with another way to onboard websites to Account Takeover Protection.
Imperva Account Takeover Protection – Added Support for Near Real-Time (NRT) SIEM
It can now send event logs to your preferred SIEM solution. Imperva pushes the event logs to your Amazon S3 bucket, enabling you to import the events into your SIEM solution. To configure the log integration for Imperva Account Takeover Protection, add a configuration for the ATO service and select the ATO log type.
Detect and prevent online fraud with Imperva
Imperva helps organizations detect and prevent fraud before it impacts their brand or bottom line, providing advanced protection against fraudulent activities. It stops fraud ranging from client-side attacks that steal sensitive data, to mitigating automated fraud that often uses that same stolen data, such as account takeover, fake account creation, transaction fraud, gift card fraud, and more. It leverages advanced technology, including machine learning and behavioral analytics, combined with human intelligence from threat researchers and expert analysts. With Imperva, organizations can have confidence in their ability to protect their customers’ data and financial information, while maintaining their reputation in the market.
- Imperva Advanced Bot Protection protects websites, mobile apps, and APIs from automated fraud without affecting legitimate users.
- Imperva Account Takeover Protection proactively blocks account-based fraud and allows you to inform consumers before they are victimized.
- Imperva Client-Side Protection prevents online fraud from website supply chain attacks like formjacking, digital skimming, and Magecart.
Try Imperva for Free
Protect your business for 30 days on Imperva.
