Insight #1
Here we go again: Verizon’s new Data Breach Investigations Report (DBIR) is out, and once again, unauthorized uses of web application credentials and exploits of vulnerabilities in web applications are among the top three on the breach list. It’s the same, lame story every single year. At what point will the industry figure out that Application Security (AppSec) status quo methods — Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), web application firewall (WAFs), etc. — aren't working? Why not give something new — like Runtime Security — a chance?
Insight #2
This year, Verizon’s DBIR dug into how quickly organizations are fixing the Cybersecurity and Infrastructure Security Agency’s (CISA’s) Known Exploited Vulnerabilities (KEV) catalog. These are the most critical vulnerabilities. The data finds that after 30 days, 85% remain unmitigated. In my opinion, this screams for the need of a mitigating control like Runtime Security to protect you from exploit against these known and currently under-exploit issues.
Insight #3
Recently, in a court case around a humongous 2018 data breach, Marriott admitted that it falsely claimed (for five years) that it was using secure AES-1 encryption. In fact, it was using SHA-1, or Secure Hash Algorithm-1: an algorithm that:
a. NIST deprecated in 2011 and
b. will be unsupported in all software and hardware devices as of Dec. 31, 2030, all because
c. it’s easy to crack.
Encryption is not hashing is not encryption. One — encryption — is meant to protect the data but still allow the system with the key to use the original data, and one — hashing — is meant to render the data irreversible in cases where the system does not need to know the original values. Unfortunately, there are weak hashing algorithms like SHA-1 that allow for retrieving the original value without the need for a key of any kind, rendering it's use extremely risky. Are you still using SHA-1? If you say “No,” are you sure? Making a mistake like that can have serious consequences.
