Securing the Modern Application: From Code to Infrastructure

Securing the Modern Application: From Code to Infrastructure

Speakers: Dr. Boaz Gelbord, Senior Vice President and Chief Security Officer, Akamai

Conference: RSAC 2024

YouTube: https://www.youtube.com/watch?v=QakfQ8j1VvU

Overview

In an era where digital transformation accelerates at an unprecedented pace, securing the myriad applications that underpin modern enterprises has become a paramount challenge. Dr. Boaz Gelbord, Senior Vice President and Chief Security Officer at Akamai, delivered a compelling talk at RSAC 2024, "Securing the Modern Application: From Code to Infrastructure," that dissected the evolving threat landscape and offered insights into contemporary defense strategies. Gelbord emphasized that this year marks a significant shift in both attacker capabilities and defender necessities, moving beyond incremental changes to a period of profound transformation.

The presentation delved into the criticality of applications, noting that the average enterprise manages over a thousand applications, each potentially interacting with dozens of others. This interconnectedness creates an expansive and complex attack surface that traditional security models struggle to protect. Gelbord highlighted the "art of the possible" from both offensive and defensive perspectives, urging organizations to re-evaluate their security postures in light of sophisticated threats like rapidly escalating API attacks, advanced DDoS techniques, and the pervasive challenge of bot traffic.

The talk served as a crucial call to action for security professionals, advocating for a fundamental re-evaluation of threat models and the adoption of more resilient, adaptive security frameworks. By providing a data-driven analysis of current attack trends and offering strategic guidance on defensive implications, Gelbord underscored the urgency of securing applications from their foundational code to their underlying infrastructure to safeguard digital society.

Background

▶ Watch: Introduction: Securing the Modern Application (0:00)

The security landscape is in constant flux, but certain periods mark more significant shifts than others. Dr. Gelbord posited that the current environment is one such transformational period, characterized by rapid changes in attacker methodologies and the increasing fragility of traditional defense mechanisms. He drew a parallel to the "art of the possible," suggesting that both adversaries and defenders are exploring new frontiers.

A key theme was the pervasive influence of Artificial Intelligence (AI), which, while not the sole focus, underpins many evolving threats. Gelbord illustrated how foundational security tenets are becoming increasingly shaky. For instance, voice authentication, once touted as a robust security measure, is now easily circumvented by readily available AI agents capable of synthesizing speech to say anything desired. This erosion of trust in once-reliable authentication methods necessitates a radical shift in security paradigms. Furthermore, many organizations still operate with outdated threat models, primarily focusing on preventing users from clicking malicious links or opening attachments, a strategy Gelbord argued is insufficient against the sophisticated, application-centric attacks prevalent today.

The talk also highlighted the sheer scale of internet activity and the corresponding proliferation of malicious traffic. Akamai's platform alone observes approximately 11 trillion DNS queries daily, indicating the vast interconnectedness of modern digital life. A striking finding from Akamai's analysis revealed that for many organizations, the volume of traffic directed to illegitimate sites can surpass that going to legitimate ones, exemplified by the US Postal Service where fake digital "post offices" outnumber real ones in terms of malicious traffic volume. This underscores the challenge of distinguishing legitimate from malicious activity at scale and the necessity for advanced protective measures that have significantly improved in recent years, enabling the identification and blocking of malicious sites and the mitigation of post-compromise actions.

Key Findings

▶ Watch: Real-world Example: Scale of Malicious Sites (3:00)

Dr. Gelbord presented a series of alarming statistics and critical observations that underscore the escalating threats to modern applications:

• Web Attack Proliferation: There has been a 48% increase year-on-year in web attacks, indicating a concentrated effort by attackers to exploit web-facing assets as primary entry points into organizations.
• API Attack Surge: Within this broader category, API attacks constitute 29% of all web attacks, and critically, have seen a staggering 109% increase year-on-year. This more than doubling of API-focused assaults highlights a significant shift in attacker focus. The speaker attributed this to the difficulty in inventorying APIs, their often complex logic making them harder to secure, and the use of unique credentials (like keys) that are more challenging to rotate and manage than traditional passwords.
• Layer 7 DDoS Escalation: Layer 7 DDoS attacks have also seen a substantial increase, rising by 107% year-on-year. These attacks, targeting the application layer, are particularly disruptive as they aim to make web applications fundamentally unavailable to legitimate users by exhausting application-specific resources.
• Exploit-Based Attacks: Citing the recent Verizon Data Breach Investigations Report, Gelbord noted an 180% increase in exploit-based attacks, with the majority leveraging web applications as their primary vector. This emphasizes the critical importance of timely patching and vulnerability management for web-facing infrastructure.
• Pervasive Bot Traffic: In 2023 alone, Akamai observed 20 trillion bot requests. The challenge lies in distinguishing between "good bots," "bad bots," and "gray bots," necessitating sophisticated bot management strategies to protect web applications effectively.
• Data Volume and Complexity: The sheer volume of data analyzed by Akamai—nearly 932 terabytes (approaching a petabyte) daily, up 20% from the previous year—illustrates the increasing complexity for defenders to identify and mitigate malicious traffic amidst legitimate operations.
• Third-Party and Supply Chain Risks: Two major trends were highlighted:
• Third-Party Breaches: Recent months have seen numerous breaches impacting identity, cloud, and VPN providers, which attackers then leverage to access enterprise "crown jewels." This "living off the land" approach utilizes an organization's own trusted tools and resources against them, making risk assessment of third parties exceptionally difficult.
• Component Vulnerabilities (XZ Utils): The XZ Utils vulnerability was cited as a "turning point" example of the profound risk posed by components installed within organizations. This open-source utility, widely used, was backdoored by a malicious entity, enabling remote code execution. The fortunate discovery by an eagle-eyed engineer at Microsoft prevented widespread exploitation, but Gelbord cautioned that countless similar vulnerabilities could be lurking undetected.
• Vulnerability Overload: In 2023, nearly 29,000 CVEs (Common Vulnerabilities and Exposures) were published. Managing this overwhelming volume, understanding their applicability, and tracking them across various sources (especially with recent challenges to the National Vulnerability Database) presents an immense and growing challenge for security teams.

These findings collectively paint a picture of an increasingly aggressive and sophisticated threat landscape, demanding a comprehensive and adaptive approach to application security.

Technical Deep Dive

▶ Watch: Shaky Foundations: Outdated Security Measures (4:00)

The talk provided a technical deep dive into several advanced attack vectors, particularly focusing on resource exhaustion techniques and the exploitation of modern protocols. A standout example was the HTTP/2 Rapid Reset attack, a novel form of Distributed Denial of Service (DDoS) that emerged in recent months.

To understand the HTTP/2 Rapid Reset attack, it's crucial to grasp the architectural differences between HTTP/1 and HTTP/2. In the older HTTP/1 protocol, a single TCP connection typically handled one request at a time. If a client wanted to make multiple requests, it would usually open multiple TCP connections or queue requests sequentially. HTTP/2, designed for improved performance, allows for multiplexing—handling multiple concurrent requests over a single TCP connection, often up to 100 or more streams simultaneously. This feature, intended to make web servers more efficient, inadvertently created a new vulnerability for resource exhaustion.

Gelbord used an analogy of a pizza delivery service to illustrate the attack. In an HTTP/1 scenario, if a customer calls a pizza place that takes only one order at a time and repeatedly changes their order, they tie up one service line. With HTTP/2, it's akin to the pizza place being willing to take 100 orders at once. An attacker could place an order for 100 pizzas and then, while still on the line, repeatedly "change their mind" about the details of each of those 100 orders. This action, rather than tying up a single service line, effectively ties up 100 times the server's resources for an extended period, making it unavailable to legitimate customers. The "rapid reset" aspect comes from the attacker rapidly initiating and then canceling numerous streams within a single HTTP/2 connection, forcing the server to expend resources on connection setup, stream management, and teardown, without ever completing a meaningful transaction. This is a highly efficient way for attackers to exhaust server resources (CPU, memory, network buffers) with minimal effort on their part.

Beyond HTTP/2, attackers are continuously exploring the complexities of modern applications across all layers, from the web server level to DNS and application-specific code. The goal is always to find ways to force the target system to perform more work than it needs to, thus consuming its resources and rendering it unavailable. This includes exploiting vulnerabilities in various components, such as application logic flaws, database inefficiencies, or even underlying operating system issues.

The talk also touched upon the persistent threat of IoT botnets. While dismissing the sensationalized "DDoS by toothbrushes" article as "fud" (fear, uncertainty, and doubt), Gelbord confirmed that numerous IoT devices are indeed being conscripted into bot armies for DDoS attacks. This often occurs due to the use of default passwords or the exploitation of previously unknown vulnerabilities in these devices, turning them into unwitting participants in large-scale cyberattacks. The proliferation of IoT devices, often with weak security postures, represents an ever-growing pool of potential attack infrastructure.

Furthermore, the discussion highlighted the attacker's perspective on attack surface management. Attackers can easily map out an organization's external footprint, often using the same tools and techniques employed by legitimate attack surface management vendors. Once inside, they exploit internal documentation and leaked credentials—a form of "living off the land"—to navigate the network and reach critical assets. This demonstrates that the attack surface is not merely external but extends deeply into the internal environment, necessitating a holistic and proactive approach to security from code to infrastructure.

Demo / Proof of Concept

▶ Watch: Key Data: Surge in Web and API Attacks (6:00)

While the talk did not feature a live technical demonstration or a specific proof of concept tool, Dr. Gelbord effectively illustrated his points using real-world data and observed trends from Akamai's extensive network traffic analysis. He referenced Akamai's daily processing of nearly a petabyte of data and its observation of 11 trillion DNS queries, providing a concrete foundation for the statistics and attack patterns discussed. The example of the US Postal Service's legitimate traffic being eclipsed by malicious traffic to fake sites served as a stark, real-life illustration of the scale of the problem. This approach allowed the speaker to convey the impact and mechanisms of modern attacks through empirical evidence rather than a simulated environment.

Defensive Implications

▶ Watch: Increasing Layer 7 DDoS and Exploit Attacks (7:00)

Given the rapidly evolving and increasingly sophisticated threat landscape, Dr. Gelbord outlined several critical defensive implications for organizations aiming to secure their modern applications:

1. Embrace Zero Trust Principles: The speaker advocated for the adoption of Zero Trust architectures, or similar frameworks that prioritize the principle of "never trust, always verify." The core idea is to ensure that every entity—user, device, application, or service—can only access precisely what it needs within the organization. This approach helps to contain the blast radius of a potential breach or intrusion by segmenting access and enforcing strict authentication and authorization at every interaction point.
2. Selective Application of Controls: Organizations must be "selective about controls." With a vast array of security solutions available, it's impossible and often counterproductive to implement every possible control. Gelbord used the analogy of wearing a helmet in a car—while it might offer an extra layer of protection, it's generally not a practical or necessary control for most people. Defenders must perform a thorough risk analysis to identify the most impactful controls that align with their specific threat model and resource constraints, focusing on high-leverage security measures.
3. Deep Understanding of the Threat Model: A strong understanding of how the organization's threat model matches the different components of its application stack—from code to infrastructure—is paramount. This is a "highly non-trivial thing to do" and requires significant effort. It means moving beyond generic security checklists to understand specific vulnerabilities, potential attack vectors, and the criticality of each application component within the organization's unique operational context.
4. Comprehensive Inventories and Asset Management: To effectively secure applications, organizations need robust inventories that map and tie together all components: code repositories, application services, underlying infrastructure (servers, containers, cloud resources), and especially APIs. The difficulty in inventorying APIs was explicitly called out as a major challenge for defenders, making it hard to know what needs protection. Without a clear understanding of what assets exist and how they interrelate, effective security is impossible.
5. Proactive Risk Analysis Across the Stack: The most critical starting point for addressing application security challenges is to conduct a detailed risk analysis that holistically assesses how code, applications, and infrastructure intertwine. This analysis should identify potential points of failure, critical dependencies, and the potential impact of compromise. This process is far more complex than it sounds, requiring cross-functional collaboration and a deep understanding of the entire technology stack.
6. Supply Chain and Third-Party Risk Management: Given the prevalence of third-party breaches and supply chain vulnerabilities (like XZ Utils), organizations must develop robust strategies for managing risks introduced by external components and vendors. This includes rigorous vetting, continuous monitoring of third-party security postures, and implementing controls that assume compromise in external dependencies.

In essence, the defensive strategy must shift from a perimeter-focused, reactive stance to an adaptive, proactive, and intrinsically secure approach that understands the full scope of the application attack surface.

Key Takeaways

• The Threat Landscape is Rapidly Evolving: Attackers are leveraging new techniques and exploiting modern application complexities, marking a significant shift from incremental security challenges to profound transformation.
• Applications are the Primary Attack Vector: Web attacks are up 48% year-on-year, with API attacks more than doubling (109% increase) and Layer 7 DDoS attacks also significantly increasing (107%), making application security a top priority.
• Foundational Security Tenets are Shaky: Traditional security models, like relying on voice authentication or simple "don't click links" training, are increasingly insufficient against AI-driven and sophisticated exploitation methods.
• Comprehensive Risk Analysis is Essential: Organizations must conduct deep risk analyses that span from application code to underlying infrastructure, building detailed inventories and understanding how all components interrelate to identify and prioritize critical controls.
• Adopt Zero Trust and Selective Controls: Implementing Zero Trust principles and selectively applying security controls based on a thorough understanding of the specific threat model are crucial for containing breaches and efficiently allocating security resources.
• Address Third-Party and Supply Chain Risks: The growing threat from third-party breaches and vulnerabilities within open-source components (e.g., XZ Utils) necessitates robust strategies for managing external dependencies and their potential impact.

About the Speaker(s)

Dr. Boaz Gelbord is the Senior Vice President and Chief Security Officer at Akamai, a leading content delivery network and cybersecurity company. With a distinguished career spanning over two decades in the cybersecurity domain, Dr. Gelbord is a seasoned expert who has been a regular presence at the RSA Conference for approximately 20 years. His extensive experience provides him with a unique vantage point to observe and analyze the evolving trends in cyber threats and defenses, making him a respected voice in the industry.