As Big Data sees more and broader application, it would be foolish to discount the significance of database hit attacks.
Database hit attacks are not very complex. For example, you may have an email account with the username abc@xx.com, and the password is x6!00AL5y@ (which is complex and secure). However, for the sake of convenience, you registered for accounts on Facebook, Ctrip, Taobao, WeChat, etc. with the same account. Using the same mailbox account and password poses security risks. This is a common practice because remembering different account/password combinations can be annoying.
As a result, the account is stolen by a hacker, probably because your mailbox leaked personal information or out of carelessness. The hacker can log in to all your accounts with the same information. Then, all information across your accounts will be stolen.
WAF provides a "10-minute solution" to help users deal with database hits. First, a WAF user takes 5 minutes to complete the online access. The new configuration rules are only valid for 2 minutes. The web application is under the protection of Cloud Security 10 minutes. You can defend against common attacks such as SQL injection, XXS, and Trojans with only a click of a button.
WAF 3.0 has developed a new kind of "black technology" called Data Risk Control. It combines cybersecurity protection capability with Alibaba Cloud Security's service security risk control to easily resolve the following issues.
• User information leakage caused by a database hit attack and brute-force cracking
• Scalpers, fake tickets, fake coupons, and fake red packets and other malicious behavior
• SMS fees generated from malicious fake SMS verification codes and SMS interfaces
• Malicious registrations of spam accounts
• Malicious interference by sniping bots
From the moment when a request accesses your website, WAF fits a complex human-computer recognition model to analyze whether the visitor meets a normal user's behaviors. For example, a normal user does not directly submit a login request when there is no page access or login portal, but the database hit attack will. In addition to analyzing behaviors, WAF combines traffic information and users' browser information with Alibaba Cloud big data information (including zombie computers, malicious IPs, malicious scripts, malicious software, etc.) to ultimately determine whether the request is normal and reliable.
When a normal user accesses the site, they aren't aware of the analysis process. They log in, register, verify, or snipe products just as they normally would. However when a user is suspected of unnatural behavior, WAF performs human-computer recognition and verification at key interfaces (such as registration and login) of Data Risk Control until the user is confirmed to be normal. This means that protection is precise and targeted, avoiding negatively impacting normal users as much as possible.
For more information, please go to How to defend against a database hit attack in 10 minutes or less.
Malware detection is a fundamental feature of web security for most websites. Alibaba Cloud has released a web application firewall (WAF) equipped with a semantically intelligent detection engine.
Alibaba Cloud Web Application Firewall (WAF) intelligent detection engine detects various web attacks through semantic attacking behavior and exception-based protection. By describing attacks semantically, Alibaba Cloud WAF intelligent detection engine is able to deal with a wide variety of attacks and their complex variants. Additionally, the security model based on exception statistical detection can not only prevent known web security threats, but also prevent unknown security threats.
When it comes to utilizing a cloud platform for your application, security is of the utmost importance. Security starts with developers who should tailor their application security practices and strategies to the type of environment their application will be deployed in. Secure development practices can mean the difference between resting easily each night knowing your application protects the consumer data with which you've been entrusted, or dealing with the constant threat of a data breach that would keep any good developer on edge.
This article highlights best practices for secure development of applications that will be deployed in a public cloud such as Alibaba Cloud (where you can take advantage of a $300 credit if you'd like to get started with deploying applications to the cloud).
This topic describes how to activate Alibaba Cloud WAF step by step.
After the website is deployed with Alibaba Cloud WAF, WAF helps inspect the web traffic and block common web attacks (such as SQL injections and XSS scripting) and HTTP flood attacks, based on the default protection settings. You can enable more protection functions and configure their policies according to your actual business situation.
The industry-leading Advanced WAF provides robust web application firewall protection by securing applications against threats including layer 7 DoS attacks, malicious bot traffic, OWASP Top 10 threats and API protocol vulnerabilities. Advanced WAF also leverages automated learning capabilities and data analysis to provide the most cutting-edge, automated protection; preventing the most sophisticated attacks from reaching your application servers.
F5 Per-App VE's offer feature parity with physical and virtual Advanced WAF appliances, allowing you to easily replicate configurations and policies to ensure a consistent security posture across multi-cloud environments. With reduced footprint and spin-up time, F5 Per-App VE's can be rapidly provisioned to meet more agile application requirements. By implementing a Per-App architecture, you limit the total impact if/when an application is compromised, as all apps are isolated from one another.
The NSFOCUS Web Application Firewall (WAF) provides comprehensive, application layer security to completely protect your critical servers and web applications.
Understand application security and common network attacks. You will master the core skills of application security on the cloud, including how to access Alibaba Cloud WAF, avoid tampering website, prevent CC attacks, and how to conduct business risk management.
2,599 posts | 762 followers
FollowAlibaba Clouder - July 12, 2019
Alibaba Clouder - June 11, 2019
Alibaba Clouder - July 23, 2020
Alibaba Clouder - December 15, 2017
Alibaba Clouder - July 12, 2019
Alibaba Clouder - January 28, 2021
2,599 posts | 762 followers
Follow
WAF(Web Application Firewall)
A cloud firewall service utilizing big data capabilities to protect against web-based attacks
Learn More
Web App Service
Web App Service allows you to deploy, scale, adjust, and monitor applications in an easy, efficient, secure, and flexible manner.
Learn More
Offline Visual Intelligence Software Packages
Offline SDKs for visual production, such as image segmentation, video segmentation, and character recognition, based on deep learning technologies developed by Alibaba Cloud.
Learn More
Web Hosting Solution
Explore Web Hosting solutions that can power your personal website or empower your online business.
Learn MoreMore Posts by Alibaba Clouder
