{"id":174257374,"date":"2022-06-23T10:00:13","date_gmt":"2022-06-23T14:00:13","guid":{"rendered":"https:\/\/www.citrix.com\/blogs\/?p=174257374"},"modified":"2023-10-11T03:15:05","modified_gmt":"2023-10-11T03:15:05","slug":"netscaler-research-highlights-common-threats-across-industry-verticals","status":"publish","type":"post","link":"https:\/\/www.netscaler.com\/blog\/news\/netscaler-research-highlights-common-threats-across-industry-verticals\/","title":{"rendered":"NetScaler research highlights common threats across industry verticals"},"content":{"rendered":"

Unlike network firewalls, which operate at layer 3 and layer 4 of the network stack, web application firewalls sit in front of the applications and operate at the application layer (L7). Their job is to monitor HTTP\/S traffic to identify requests and responses that break protocol rules or application-specific policies, then filter or block that traffic and secure the application.<\/p>\n

Recent research by the NetScaler Cyberthreat Research Initiative team used attack metadata from NetScaler ADCs deployed in enterprise networks to generate insights into the application risks that customers were exposed to. The team\u2019s findings were consistent across most industry verticals and aligned with the threats highlighted in the OWASP Top 10.<\/p>\n

In this blog post, we\u2019ll share findings that highlight how pervasive these threats are across a range of industry verticals, from DDoS attacks against critical resources due to buffer overrun to the possibility of installing malware because of inconsistent cookie checks in applications.<\/p>\n

The top 5 most prevalent application attacks<\/h2>\n

NetScaler used NetScaler Web App Firewall analytics to identify the top five attack types seen in customer environments. In conducting our research, we collected and de-identified data from a global customer base across a range of industry verticals during a one-year period (April 2021 to April 2022). The five most common application attack types detected by NetScaler Web App Firewall in customer environments during this period were:<\/p>\n

    \n
  1. Direct request (forced browsing)<\/li>\n
  2. Cross-site scripting<\/li>\n
  3. SQL injection<\/li>\n
  4. Buffer overflow<\/li>\n
  5. Cookie consistency<\/li>\n<\/ol>\n
    \"\"
    Figure 1. Percentage of customers who experienced each attack type<\/figcaption><\/figure>\n

    Let\u2019s look at the basics of each attack type. In many scenarios, a web application firewall with the right policy sets configured and deployed in front of the application can help organizations detect and mitigate these attacks.<\/p>\n

    Direct request (forced browsing) – CWE-425<\/a>:<\/strong> With direct request attacks, it\u2019s possible to bypass application authentication and authorization and breach or change corporate resources. If not mitigated, a direct request attack can have implications on the confidentiality and integrity of an organization\u2019s data.<\/p>\n

    Cross-site scripting – CWE-79<\/a>: Unauthorized scripts injected into a response and executed on a user’s browser can have consequences including:<\/p>\n