Akamai Diversity

The Akamai Blog

Akamai SIRT Alerts

Akamai SIRT Alerts

January 7, 2016 7:11 AM

Delegate v9.9.13 setuid Binary Vulnerability

By Larry W. Cashdollar, Akamai SIRT A few weeks ago I noticed a tweet from someone I have been following off and on for a few weeks. The tweet highlighted an exposed administration panel in a software product called Delegate. The Delegate software is described as, "a multi-purpose application-level gateway, or a proxy server which runs on multiple platforms (Unix, Windows and MacOS X)". What this software does is allow

Les Waltman

Les Waltman

January 6, 2016 1:27 PM

The move to an Encrypted Web

It wasn't too long ago that the only reason a site would leverage HTTPS was to encrypt sensitive data so it couldn't be read in transit. Times are changing and the Internet as we know it is moving more and more towards encrypting all website traffic. Below are 7 good reasons to move your website to only use HTTPS.

Miguel Serrano

Miguel Serrano

December 21, 2015 2:07 PM

WAF: Ease of management

In my last articles I introduced the idea of how simple is the concept of a WAF (although implementing a reliable WAF system is not that simple), what are false positives and false negatives and the best approach to trade-off between them, what is the impact of wide visibility when it comes to build a WAF, the importance of having a solid team of experts backing up a WAF solution,

Miguel Serrano

Miguel Serrano

December 18, 2015 11:18 AM

WAF: Adequate scale

Let's move on with our analysis of the ideal WAF requirements. Scale is, without a doubt, one of the most important requirements of an effective WAF. Scale has to be considered from two perspectives: under standard traffic conditions and under unusually high levels of traffic. Let's look at each one.

Martin McKeay

Martin McKeay

December 18, 2015 10:27 AM

How 2015 Security Trends Will Influence 2016

I've always hated security 'predictions'; they range from scientific guesses to self-serving marketing drivel, trending mostly towards the latter. But they do serve a purpose when done right, in that they draw attention to the trends currently happening and how they might play out in the future. Given that there's been more focus on the field of computer security in 2015 than in any year before, it's probably not a

Miguel Serrano

Miguel Serrano

December 16, 2015 11:07 AM

WAF: Threat Intelligence, the brain behind the machi ...

First time I jumped into a plane I was around 10 or 12 years old. The crew, moved by my innocent face and my dazzle, gave me a great gift: they allowed me to enter into the cabin where the pilot was commanding the flight. This is what I saw:

Miguel Serrano

Miguel Serrano

December 14, 2015 1:39 PM

WAF: Visibility into attacks and adaptability to cha ...

In previous posts WAF: False Positives vs. False Negatives and WAF: trade-off between false positives and false negatives, we talked about the importance of WAF accuracy and the strategy that Akamai follows when developing the system of proprietary rules (Kona Rule Set or KRS) that govern the WAF.

Or Katz

Or Katz

December 14, 2015 11:38 AM

Playing Hide and Seek In the Cloud

When we were young, we had fun playing hide and seek. As 5 year olds there were a limited number of places our friends could hide, and we could methodically check each one and then giggle when we found them. As we grew older, we expanded the boundaries of the game. Today, as security researchers, hide-and-seek is no longer so fun because the boundaries are nearly infinite. How do you

Miguel Serrano

Miguel Serrano

December 11, 2015 11:38 AM

WAF: trade-off between false positives and false neg ...

In the previous article, we introduced, arguably, the most important metric to measure WAF quality (in subsequent entries we will talk about WAF performance). But we left one question flying in the air: How can we achieve that our WAF rules provide a virtually null False Positive rate, keeping at the same time a very low percentage of False Negatives?