With this article, we are continuing the series: How Cloudbric Prevents Data Leakage with a focus on identity protection. In 2014, total cases of identity theft in the United States alone reached 18,000,000– 37% over 2013.
As we shared in our How Cloudbric Prevents Data Leakage: Parameter Tampering article, most data breaches are caused by web attacks and these web attacks access or send unauthorized requests to the victim’s web server so an attacker can access the server’s outgoing sensitive data. However, Cloudbric does not only protect websites by monitoring incoming website traffic. Cloudbric also protects against hackers’ backdoors. A backdoor is unauthorized access to your website that a hacker created that is hidden to you. They are often hidden in one of your many files in your website and are hardly distinguishable from your normal files. In the case of a hacker programming a backdoor to quietly export your private information, Cloudbric also analyzes all outgoing information from your web application to ensure none of your precious data is leaving.
Identity theft or the evasion of information privacy is directly linked to data leakage. Your or your users’ private data (names, addresses, credit card and social security numbers, etc.) leaking and thus, being accessed by those attackers are ultimately used to steal your or your users’ identities. For unprotected websites, hackers can freely access a web app’s information through its vulnerabilities and export it as they please. Once a hacker gains access to a website, he can program a backdoor to access it undetected in the future. In addition, most website security software actually do not detect backdoors because they are not malicious code and look almost identical to your normal files’ code. However, the biggest problem with backdoors is that even if you find the backdoor and patch it, hackers have already accessed your web app and may have already programmed the controls to distribute malware and spam to your users, steal private information, or even use your website as a bot for DDoS attacks.
What Are Your Options?
It is important to have a programmer (or team of programmers) constantly testing your web applications to ensure that there are no backdoors hidden in any of your application’s files. However, it is also critical to protect your website with highly advanced security. Every moment is critical as a hacker only needs a few minutes to compromise your web app’s security and steal your information. To have comprehensive website security, you need a web application firewall (WAF) to act as a proxy for all outgoing traffic, so that hackers enter your website and sneak about with private information.
How Does Cloudbric Protect My Website?
Cloudbric is a logic-based WAF solution that is able to detect the most elusive backdoors. Normal WAF services use signature-based pattern-matching recognition software to determine if incoming or outgoing traffic have good intentions based on IP whitelists and blacklists. This means that their recognition software only recognizes known backdoor methods. However, that method is not highly accurate because hackers constantly change their method of attack. Unlike our competitors, Cloudbric uses detection technology based on WAPPLES, a Logic Analysis Engine, that recognizes the characteristics of hackers and applies that learning to recognize the characteristics of hacking attempts from both incoming and outgoing traffic, like using backdoors.
Cloudbric recognizes any HTTP requests for exporting personal information and monitors those requests to ensure that information that you consider private can never be exported from the app. Cloudbric lets you decide what information is private depending on your business’s needs and whether or not you want to completely block all requests for private information or if you want to mask (encrypt) them. Perhaps to you, your users’ order details are considered private information, so you may want to mask the information (like the diagram above) as opposed to completely blocking all private information requests. You can set the rules to block or mask HTTP responses for what you consider to be private which include, but are not limited to, social security numbers, credit card numbers and email account information. So with Cloudbric, you do not need to worry about your private information ever being stolen.
Even though the threat of online identity theft is increasing year over year, managing a website should not be intimidating. Hackers’ attacks can be stopped if website owners are vigilant and increase their website security. Use a highly intelligent WAF service to protect your website to prevent private data leakage and ultimately, stop the identity theft of your users and yourself.
If you would like to learn more about Cloudbric’s logic-based WAF service, please contact us at global@cloudbric.com.