Get In Touch
It's that time of year again. Here at our global headquarters in Cambridge, Massachusetts, the days are getting shorter (at least in terms of sunrise and sunset). Gone are the 90 degree days of summer; 60 is the new normal. And as we are now in the midst of the final months of the year, Starbucks is bringing back its Pumpkin Spice Latte. Just kidding...that happened in August. Here in
by Don Ng and Greg Burns This October, Akamai is announcing the turn-up of two additional Prolexic DDoS mitigation scrubbing centers in Singapore and Osaka, building on the nine previous scrubbing centers turned up this year and adding to our existing APJ footprint in Sydney, Tokyo, and Hong Kong. The new regional centers add approximately 800 Gbps to the Prolexic platform's bandwidth to 7.8 Tbps of dedicated attack mitigation capacity.
by Volker Tegtmeyer and Hans Cathcart Are your APIs protected? Do you feel your business data is safe? Application Programming Interfaces (API) are a great tool for developers to build new applications faster. They're great for helping businesses implement and evolve new business models faster by enabling different software programs to talk to each other quickly. They're also a great way for growing mobile applications to get information in front
by Volker Tegtmeyer and Hans Cathcart Have you ever felt like you did a great job protecting your mission-critical web applications, only to realize so many more web properties require your attention? Web properties are not all equal, and overloaded security teams can only focus on the most critical ones. As a result, there have been several evolving consequences for many organizations:
Todays comprehensive monitoring capabilities in Security Center provide great insight into bot activity and countermeasures applied across your valuable web properties. Filter options allow you to focus on almost any desired detail. However, understanding what is happening on specific protected endpoints requires an understanding of not only Web Security Analytics, but also how you should translate a specific question into a sequence of filters. This can be tedious for a
Credential stuffing, and the botnets behind this activity, is the primary focus of the State of the Internet Security Report, Issue 4, 2018. Credential stuffing, the use of botnets to try to login to a site with stolen or randomly created login information, isn't a new phenomenon, but it is one that is having a growing impact, especially on financial services organizations. Our latest report takes a deeper look at
On Wednesday, August 22nd, the Apache team patched another vulnerability in the Apache Struts2 framework. Apache Struts is an open-source web application framework for developing Java web applications. The vulnerability exists when these conditions are met: The alwaysSelectFullNamespace flag setting is set to true in the Struts configuration. The Struts configuration file contains an <action ...> tag that does not specify either the optional namespace attribute or a wildcard namespace.
In March 2017, Akamai released a post, "On Web Cache Deception Attacks". A presentation at the Black Hat conference by James Kettle from Port Swigger on web cache poisoning has recently raised awareness of cache poisoning. This is a class of vulnerability with a long history. Cache poisoning can be defended against by properly configuring caching controls on both customer sites and the Akamai platform. Customers should consult with their
On the week of July 15th, researcher Juha-Matti Tilli disclosed a vulnerability in the Linux kernel to the kernel maintainers, the National Cyber Security Center - Finland (NCSC-FI), CERT Coordination Center (CERT/CC), and Akamai. The vulnerability, CVE-2018-5391, is a resource exhaustion attack triggered by a specially crafted stream of IP datagrams that cause expensive processing within the Linux kernel. This vulnerability is similar to the Linux TCP vulnerability announced August,