Exploring Cybersecurity's Stressful Side

Hey there, cyber defenders! Ever feel like you're in a never-ending game of whack-a-mole? You're not alone. Let's take a moment to talk about something super important: mental health in the world of information security. Then, we'll dive into a bit of cybersecurity history.

The Weight of the Work

Being a tech worker can be tough. It turns out, we're way more likely to deal with mental health problems than folks in other fields. How much more? Tech workers are five times more likely to face these challenges.   

CISOs, we see you. You're carrying a heavy load. A recent report shows that nearly 9 out of 10 CISOs feel seriously stressed. And here's another punch to the gut: many CISOs end up working a ton of unpaid overtime—think $35,000 worth a year. This kind of stress can lead to burnout. In fact, the average CISO only stays in the job for about 26 months. That's a really high turnover rate!   

The Relentless Enemy

The bad guys never seem to take a break. The FBI says that cyberattack complaints are through the roof—almost 4,000 a day. And it seems like they’re always finding new ways to weasel in. Attacks that use COVID-19 as a lure, like phishing, have skyrocketed to around 30,000 a day in the U.S. alone.   

What does this mean for us? More work, plain and simple. It often feels like the workload is growing faster than teams can keep up. This can mean security pros rarely get a moment to breathe between incidents. For those in incident response, stress levels can go through the roof.   

A Reminder to Be Kind

Let’s be real: stress is a major issue. The pandemic has only made things worse. Many of us have faced incredibly tough situations—kids at home, family members getting sick, and not being able to do the things that normally help us relax.   

So, let's all try to be kinder to ourselves. If you're in charge, show some compassion. And if you're on the front lines, remember your leaders are under pressure too. Good leaders care deeply about their teams.   

A Blast from the Past: Tetris and Early Threats

To shift gears a bit, let's take a trip down memory lane...and play a quick round of Tetris!

Tetris may seem like a simple game, but it has an interesting history. Did you know that the guy who invented it, Alexey Pajitnov, combined the word "tetra" (meaning "four") with his favorite sport, tennis?.   

Here are some fun facts about Tetris:

Tetris can cause hallucinations. Some people see falling blocks when they close their eyes, or even in their dreams!.   

The music is a love song. That catchy tune is actually based on a 19th-century folk song.   

1986: A Year of Change (and a Hacker)

Let's rewind to 1986. A lot was happening that year!

The U.S. launched a satellite, and the Soviets launched a space station.   

Rupert Murdoch started the Fox network.   

Haley's Comet graced the sky.   

Kodak left the instant camera game, and Microsoft went public.   

The Chicago Bears won the Super Bowl.   

But here's where it gets relevant to us: In 1986, a German hacker named Marcus Hess pulled off a serious stunt.   

Hess hacked into a gateway at Berkeley and used that connection to sneak into Arpanet. He then infiltrated 400 military computers, including mainframes at the Pentagon, with plans to sell secrets to the KGB.   

What’s even crazier? He was caught by an astronomer named Clifford Stoll, who set up a honeypot. Talk about an unexpected hero!   

The Scary Early Days of Cybersecurity

Early antivirus (AV) products were a big deal, but they had a major limitation: they relied on signatures and strings.   

What are signatures? In cybersecurity, a signature is like a fingerprint for a cyberattack. It's a pattern that can be found in malicious code or network activity. This could be a series of bytes in a file, unauthorized software running, or unusual network access.   

Signature-based detection: This was the main way to fight off threats like viruses, malware, worms, and Trojans. AV tools would look for the signatures of known attacks and then block or remove them.   

The Problem with Signatures

So, what's the catch? Signature-based AV can only protect you from known threats. And the bad guys are constantly creating new attacks. This means you could be vulnerable to anything new.   

Sure, signature-based detection can stop copycat attacks, which are common. But in the early days, cybersecurity was mostly reactive—waiting for an attack and then responding. This meant security teams had to be on high alert all the time, knowing that a new, unknown threat could strike at any moment. That's a scary way to live!   

Join CISO Platform — the CyberSecurity Community
Gain exclusive insights from top security professionals and access cutting-edge research.
Join Now

By: Nathan Zimmerman (Sr. Information Security Officer, YMCA)

Businesses of all sizes, whether in the financial, transportation, retail, communications, entertainment, healthcare, or energy sectors, are impacted by cybersecurity. Cyberthreats are commonplace. Cyberattacks have increased in frequency and maliciousness, including ransomware, phishing, and distributed denial of service attacks against networks. Growing cyberthreats to business operations, reputation, and intellectual property theft can impact a company's viability in addition to its stock price.

Although some may find it challenging, the increasingly complex cyber threat scenario enabled by AI automation of attacks, deep fakes, and polymorphic malware, has made it even more necessary to implement cyber hygiene. Fortunately, a company's security posture can be greatly strengthened by simply doing the bare minimum of steps. To lower your risk of becoming a hacker, everyone should take into account the following cyber hygiene guidelines:

A Short Checklist of 10 Items for Cyber Hygiene

1) Make sure your company has a risk management plan that examines particular requirements and vulnerabilities and facilitates efficient incident response. The strategy ought to cover the ramifications of new technologies like artificial intelligence and their potential use in cyber protection.

2) Following release dates, patch and upgrade your operating system, networks, and devices right away. Do this on a regular basis.

3) Make sure your passwords are strong and not easy to guess

4) Include multifactor authentication with biometric levels.

5) Consider using strong encryption on sensitive data, preferably quantum-resistant

6) Use Identity Access Management and a Zero Trust approach by knowing what people and devices are in the networks and what user privileges they may have.

7) Employees should be taught how to use social media appropriately and to be alert to spear-phishing attempts. Increase the difficulty of social engineering by anyone attempting to get your info. Employees may find that gamification and repeated training assist them in changing their behavior.

8) The most popular assault for breaches and exploitations is still phishing. Regularly back up your sensitive data and think about keeping a copy on a machine that isn't on the network.

9) Steer clear of public networks, and if you must, use a VPN.

10) For small and medium-sized businesses without in-house knowledge, a Managed Security Service Provider (MSSP) or Managed Service Provider (MSP) can assess, suggest, and safeguard your cyber assets.

The Importance of Having a Cyber-Preparedness Plan

It is not just cyber hygiene that is important but also having a substantive strategy to stay secure and be resilient.

Cybersecurity fundamentally requires a risk management approach. It calls for alertness and includes training staff, discovering gaps, mitigating vulnerabilities, reducing risks, The guiding principles of the National Institute of Standards and Technology (NIST) Framework—Identify, Protect, Detect, Respond, Recover—should also be familiar to every employee, and especially those who are a part of the C-Suite.

Technologies, procedures, and policies are all components of cybersecurity. Although each organization has its own culture, mission, and skills, management (including board members) and staff are responsible for monitoring those aspects of cybersecurity. This is especially important now that machine learning tools and generative artificial intelligence are both growing in use and sophistication by both attackers and defenders.

Effective communication is the foundation of cybersecurity. Executive management, the CTO, the CIO, and the CISO must coordinate their objectives, work together, and evaluate their information security programs, controls, and network safety on a regular basis. Through the exchange of threat intelligence and innovative security advances, communication facilitates preparedness. It is also crucial that all employees, particularly the board, receive security awareness training.

Effective cybersecurity calls for expertise. A corporate board should ideally consist of both external and internal subject matter expertise. Executive management can always benefit from outside specialists' opinions and suggestions. It keeps one from becoming complacent. Legal compliance, cybersecurity technology solutions and services, training, liability insurance, governance, and policy should all be included in areas of special expertise.

Understand the new cyber ecosystem. Technologies such as artificial intelligence, 5G, Cloud/Edge computing, and soon-to-be quantum computing are impacting the landscape. I recently wrote a book called that helps serve as a roadmap for understanding and leveraging the next wave of tech advancements. Amazon.com: Inside Cyber: How AI, 5G, IoT, and Quantum Computing Will Transform Privacy and Our Security: https://search.app/tjsdrjgEw8xCeBCR6

About the author:

Chuck Brooks currently serves as an Adjunct Professor at Georgetown University in the Cyber Risk Management Program, where he teaches graduate courses on risk management, homeland security, and cybersecurity. He also has his own consulting firm, Brooks Consulting International.

Chuck has received numerous global accolades for his work and promotion of cybersecurity.  Recently, he was named the top cybersecurity expert to follow on social media, and also as one of the top cybersecurity leaders. He has also been named "Cybersecurity Person of the Year" by Cyber Express, Cybersecurity Marketer of the Year, and a "Top 5 Tech Person to Follow" by LinkedIn”. Chuck has 123,000 followers on his profile on LinkedIn. He has keynoted dozens of global conferences and written over 350 articles relating to technologies and cybersecurity. He has authored a book, “Inside Cyber”  that is now available on Amazon. Amazon.com: Inside Cyber: How AI, 5G, IoT, and Quantum Computing Will Transform Privacy and Our Security: 9781394254941: Brooks, Chuck: Books

In his career, Chuck has received presidential appointments for executive service by two U.S. presidents and served as the first Director of Legislative Affairs at the DHS Science & Technology Directorate. He served a decade on the Hill for the late Senator Arlen Specter on Capitol Hill on tech and security issues. Chuck has also served in executive roles for companies such as General Dynamics, Rapiscan, and Xerox.

Chuck has an MA from the University of Chicago, a BA from DePauw University, and a certificate in International Law from The Hague Academy of International Law.

- By Chuck Brooks (President, Brooks Consulting International)

Original link of post is here

PAYMENT PAGE SECURITY; Navigating PCI DSS v4.0: Insights on Requirements 6.4.3 and 11.6.1

Interview with Ed Leavens, Founder and CEO of DataStealth

As the March 31, 2025 deadline for PCI DSS (Payment Card Industry Data Security Standard) v4.0compliance approaches, businesses face heightened pressure to meet new standards, particularly those related to the management and monitoring of third-party scripts on payment pages (requirements 6.4.3 and 11.6.1). I was able to interview Ed Leavans, CEO of DataStealth, on how to most effectively address payment compliance and security challenges.

Chuck Brooks: Thank you for joining us, Ed. PCI DSS v4.0 brings a lot of changes, with requirements 6.4.3 and 11.6.1 being particularly challenging. Can you start by explaining why these requirements are so significant?

Ed Leavens: Absolutely. These requirements address critical aspects of payment page security. Requirement 6.4.3 focuses on ensuring that all scripts on payment pages are inventoried, authorized, and monitored for integrity. Requirement 11.6.1 takes this further by mandating mechanisms to detect and alert on unauthorized changes to payment pages. These measures are essential because payment pages are prime targets for attackers aiming to intercept sensitive customer data, such as cardholder information.

Chuck: What makes these requirements particularly challenging for organizations to implement?

Ed Leavens: There are several challenges. First, maintaining an accurate and up-to-date inventory of scripts on payment pages is easier said than done, especially for organizations with complex e-commerce ecosystems. Many companies rely on third-party scripts, which are not always transparent or stable.

Second, detecting unauthorized changes in real-time requires sophisticated monitoring tools. The dynamic nature of modern websites and the variability of consumer browser environments make it difficult to achieve reliable detection.

Finally, there’s the challenge of balancing security with user experience. Overly restrictive measures can disrupt website functionality or create friction for customers, which no business wants.

Chuck: Script-based solutions have been a popular approach to tackle these issues. Why are they often insufficient?

Ed Leavens: Script-based solutions have two main flaws in their approach.

First, script-based solutions do not support 100% of the browsers being used by consumers today. For unsupported browers, which can represent a significant percentage of webpage traffic, they offer no protection.

Second, script-based solutions rely on one script to detect tampering with another script. But when you think about it, the whole point of these requirements is to stop scripts from being tampered with - because all scripts are susceptible to tampering. Using a script to protect a script makes no sense.

Chuck: What are some common pitfalls organizations face when trying to comply with these requirements?

Ed Leavens: One common pitfall is underestimating the complexity of these two requirements. Many organizations don’t have the time or resources to install and manage a solution, create a full inventory of the scripts running on their payment pages, manage changes and updates to the scripts on their payment pages, let alone a system to validate, approve and manage this process ongoing.

Another issue is relying on solutions that don't provide end-to-end visibility or protection. For example, some companies focus solely on detecting changes without implementing robust protection measures. Seeing a problem is one thing. Stopping it is something different all together.

Lastly, a lack of cross-functional collaboration inside an organization can also be a problem. Compliance with these requirements often requires input from IT, security, and business teams, and silos can lead to gaps and delays in implementation.

Chuck: How do you recommend organizations approach compliance with these requirements?

Ed Leavens: The first step is conducting a thorough assessment of your payment page ecosystem to understand all the components and their interactions. Create and maintain a comprehensive inventory of scripts and establish a clear process for approving and managing them.

Next, implement robust monitoring and detection mechanisms that go beyond just scripts to include other aspects like HTTP headers and metadata. These tools should alert your team to unauthorized changes in real-time.

Finally, focus on testing and validation. Regularly test your systems to ensure they are not only compliant but also effective at mitigating real-world risks.

Chuck: With the compliance deadline of March 31, 2025, approaching, what advice would you give organizations that are still in the early stages of preparation?

Ed Leavens: Start now. The requirements are technical and demand a significant amount of work to implement effectively. Even if you’re in the early stages, break the work into manageable parts. Begin with the inventory and authorization process for scripts and then layer on monitoring and detection capabilities.

Buy, don’t build. Consider engaging external experts or third-party vendors that can help bridge gaps in your current capabilities and that can provide valuable guidance and accelerate your compliance efforts.

Chuck: Thank you, Ed. For those interested, there’s a webinar on December 12, 2024, discussing PCI DSS v4.0 and how organizations can prepare. Any final thoughts?

Ed Leavens: Just that preparation is key. These requirements aren’t just about compliance; they’re about protecting your customers and your reputation. The sooner you start, the better equipped you’ll be to handle these challenges.

Chuck: Thank you for your insights, Ed.

Ed Leavens: Thank you.

IMPORTANT NOTE:

🚨 PCI DSS v4.0 includes significant requirements that are due by March 31st, 2025 and will apply to ALL organizations processing payments online.

We’re talking specifically about 6.4.3 and 11.6.1, and the solution isn’t a simple one.

That’s why we’re hosting a live webinar to do a deep dive into the latest version of PCI DSS v4.0 and we’re leaving ample time to answer all of the questions you won’t find answers to online.

Join Cybersecurity Expert Chuck Brooks and DataStealth.io on Dec 12, 2024, at 1:00 PM ET.

We’ll cover:

✅ Key insights into PCI DSS v4.0 requirements 6.4.3 and 11.6.1, and why they matter.

✅ How to align your security policies and processes with the latest compliance standards.

✅ Real-life examples of how businesses today are addressing these requirements.

✅ Common pitfalls to avoid when preparing for compliance.

✅ Expert guidance from Chuck Brooks, a global cybersecurity thought leader, on navigating complex security requirements.

🎁 And as a bonus, all webinar attendees will receive an exclusive consultation offer to assess any existing payment page with a detailed script analysis followed by personalized advice on the next steps to comply with requirements 6.4.3 and 11.6.1.

👇  Register here

https://hubs.li/Q02ZDl-10

- By Chuck Brooks (President, Brooks Consulting International)

Original link of post is here

Cybersecurity is on the brink of significant transformation as we approach 2025, grappling with escalating complexities driven by advancements in technology, increasing geopolitical tensions, and the rapid adoption of AI and IoT. In this blog, I’m exploring these changes, grouped under key categories that I’ve used in previous years, to help business leaders and cyber risk owners better prepare for the evolving landscape.

Threat Actors

Cybersecurity threats are growing more complex and persistent, driven by the heightened activities of nation-state actors and increasingly sophisticated cybercrime groups. The next year is set to test global defences as these adversaries amplify their tactics, targeting critical infrastructure and small businesses, intensifying their use of advanced strategies. Here’s what we can expect and how organisations can prepare.

Nation-State Actors: The Masters of Long-Term Infiltration

Geopolitical instability and the looming threat of global conflict are accelerating state-sponsored cyberattacks. When Microsoft published their Digital Defense Report they revealed that of the 600-million cyberattacks they face daily, 34% of them were from nation state threat actors.

Nation-state attackers are no longer interested in quick disruptions or data theft alone. Over the past year, a clear shift has emerged towards long-term infiltration, where these actors sit in wait, embedding themselves inside systems for months or even years. It’s a strategy of patience, allowing them to gather intelligence, assess vulnerabilities, and wait for the perfect moment to act—whether to disrupt operations, extract data, or gain geopolitical leverage.

Critical infrastructure face heightened risk from targeted disruptions, as do small businesses who are the backbone of the economy. Sectors like energy, healthcare, transportation, utilities, and financial systems are increasingly at risk because they are integral to national security and daily life. The USA has already flagged concerns about threats from China, while the UK continues to monitor activities especially those attributed to Russia—all while similar dynamics play out worldwide. The potential impacts are severe—crippling supply chains, compromising emergency services, or even destabilising the financial systems of entire countries.

Often, the intent of these attacks isn’t solely disruption but rather intelligence gathering and long-term strategic advantage. For example, an attacker could map a country’s power grid vulnerabilities without triggering any alarms, setting the stage for future, large-scale operations.

Organised Cybercrime Groups Up Their Game

Cybercriminals aren’t resting on old tactics with cybercrime expected to hit $12 trillion in 2025. Ransomware remains a prominent threat, but the methods have evolved. Double extortion ransomware is now a preferred technique—a devastating one-two punch where attackers not only encrypt a company’s data but also steal sensitive information. The stolen data is then used as leverage, with threats of public leaks or regulatory repercussions (such as SEC notifications), leaving victims with little recourse.

But it doesn’t stop there. These groups are also shifting toward more human-centric exploits, like social engineering and insider assistance. Insider threats are particularly insidious, as attackers increasingly rely on employees—malicious or unwitting—as entry points. Sophisticated social engineering tactics, phishing campaigns, or financial incentives make it easier for cybercriminals to use insiders as tools for gaining access and maintaining their foothold in systems rather than hacking in.

Additionally, the use of customisable ransomware-as-a-service (RaaS) platforms is now mainstream, enabling even novice threat actors to launch professional-level attacks. With 24% of all data breaches using ransomware, this commoditisation of cybercrime significantly broadens the field, resulting in a sharp increase in the frequency and variety of attacks.

Insider Threats as a Growing Concern

Insider threats represent one of the most underestimated vectors in this evolving landscape. Employees—whether compromised through coercion or negligence—can be exploited to bypass even the most sophisticated security measures. Often, these threats are deeply hidden, making them harder to detect and manage than external attempts.

An insider unknowingly clicking a phishing link or downloading a malicious file could leave the door wide open for attackers. Worse still, malicious insiders could actively collaborate with threat actors, providing detailed system knowledge or direct access to secure areas. Businesses must step up efforts to monitor unusual activities, implement behaviour-based analytics, and cultivate a culture of cybersecurity awareness to mitigate these risks.

Types of Cyberattacks

Cybercriminals are superb at innovating, and each year, the methods they use become increasingly sophisticated. Social engineering tactics such as phishing will not only remain prevalent but evolve as attackers leverage AI to craft highly personalised attacks (spear phishing and whaling) , mimicking a victim’s tone or referencing contextual details with alarming accuracy using data from social media, public records, and other sources. Deepfake technology will amplify this by creating convincing impersonations of executives or trusted sources to deceive targets. Everyone remembers when a finance worker paid out $25m to an impersonated CFO on a multi person conference call?

AI Malware will become smarter, and capable of learning from detection attempts and adapting in real time to evade security barriers. For example, it may disable certain defences while masking its activities to appear as normal system behaviour. Alternatively, as more companies implement AI agents – advanced chatbots, more threat actors will target them.

Ransomware will evolve significantly in 2025, with attackers introducing more aggressive tactics to maximise pressure on victims. One such method is Triple Extortion, where beyond locking data and threatening its public release, attackers also target a company’s partners, customers, or supply chain to amplify demands. Another emerging tactic is Data Wiping Ransomware, where attackers may abandon monetary demands altogether, opting instead to disable systems or erase data as a form of ideological or geopolitical warfare. These strategies signal a shift towards more destructive and far-reaching impacts in ransomware attacks.

Supply chain compromises will become increasingly favoured by attackers because they allow them to infiltrate networks via trusted third parties. Software vendors, open-source software, cloud services, and hardware suppliers remain particularly vulnerable. By enabling a compromise at source and inserting malicious code into legitimate software updates or manipulating open-source libraries relied on by thousands of organisations, or hardware backdoors, with attackers embedding vulnerabilities into hardware supply chains, attacks will become more challenging to detect and manage over the long term.

As a result, critical infrastructure will face mounting threats as cybercriminals exploit vulnerabilities in supply chains and essential services, often causing widespread disruptions. With the interconnectedness brought about by IoT and edge computing, attacks targeting dispersed data will increase, posing challenges in securing distributed networks.

Blindspots and Weaknesses

Shadow AI

Shadow IT has long exposed organisations to risks through unauthorized software and applications that bypass security protocols. The emergence of shadow AI—unauthorised AI tools used without IT approval—amplifies these vulnerabilities. Research by e2e-assure reveals a significant gap between perception and reality; while 85% of cyber risk owners express confidence in their AI policies, only 34% of employees are even aware such guidance exists. This disconnect heightens the risk of data breaches, regulatory non-compliance, and weakened security frameworks, creating fertile ground for cyber threats and data mismanagement.

Ethics

The ethical challenges posed by advancing AI technologies will demand urgent attention in 2025. These challenges include bias and discrimination embedded in algorithms, privacy violations due to enhanced surveillance capabilities, and the difficulty of assigning accountability for decisions made by AI systems.

Addressing these issues requires the active involvement of all stakeholders—governments, organisations, technologists, and the public—to build ethical frameworks that strike a balance between safeguarding public interests and fostering innovation. Transparency must be a foundational pillar in AI development, ensuring that systems are explainable and free from hidden biases. Inclusivity is equally critical, with diverse perspectives shaping the direction of AI to ensure it reflects the values of a broad society. Continuous evaluation is vital, enabling periodic checks to align AI systems with evolving ethical standards and societal priorities. By taking these steps, we can harness AI’s potential responsibly and equitably for a more secure and ethical future.

Human Factor Vulnerabilities

Human factor vulnerabilities will remain a critical challenge in 2025, even as organizations adopt advanced technologies to fortify their defenses. Cyber threats often exploit human errors, whether through phishing attacks, weak passwords, or lapses in protocol. This reinforces the pressing need for comprehensive training and awareness programs that foster a culture of vigilance and cybersecurity best practices throughout the workforce.

Incident Response Preparedness

Equally important is incident response preparedness; organizations must have robust crisis response plans in place to act swiftly and effectively during security breaches. These plans should include detailed protocols, clear communication channels, and regular drills to ensure readiness. By prioritizing human-centric cybersecurity and bolstering crisis response capability, organizations can enhance their resilience against the evolving threat landscape and minimize potential damage.

CISO Perceptions

A critical blind spot for CISOs and cyber risk owners is the divergence in perceptions of their security stack’s effectiveness between leadership and technical teams. While the majority of the C-suite considers their security stack highly capable, a significant number of ITOps professionals see it differently. This gap indicates a disconnect where executives primarily focus on overarching strategy, whereas ITOps face operational challenges firsthand. Bridging this divide requires stronger communication to align perspectives and ensure a cohesive defense strategy. For a deeper analysis of these disparities, explore the insights shared in the latest ManageEngine report.

Cyber Approaches

To counteract these evolving threats, organisations must pivot from reactive defenses to proactive strategies. AI-powered tools will play a vital role in enabling real-time detection, predictive threat modeling, and responsive threat mitigation. For instance, AI-driven Security Operation Center (SOC) co-pilots will assist in analysing massive data streams, prioritising incidents, and improving efficiency.

Further, organisations will increasingly adopt zero-trust architectures to combat identity-based threats – which have just taken over endpoints as the primary attack vector, focusing on strict identity and access management (IAM) practices, passkeys, and enforcing multi-factor authentication (MFA).

Quantum-resistant cryptography will also emerge as a critical investment as quantum technology poses new risks to conventional encryption standards.

Regulations and Guidance

According to analyst Gartner, 69% of employees have bypassed cyber security guidance in the last 12 months, while 74% said they would be willing to do so if it helped them to achieve a business goal. By 2025, the regulatory landscape is set to undergo significant transformations with the introduction of stricter data protection laws and compliance requirements globally. While regulators understand that perfection is impossible, they are leaning into a global trend and revising expectations for cybersecurity. They want to see organisations building out and making visible their practices and procedures for how they navigate incidents, as well as anticipating and preparing for new ones. This evolving framework pushes businesses to prioritise robust cybersecurity measures that align with both operational needs and regulatory demands.

Key developments include:

1. USA: The return of the Trump administration heralds a likely shift toward deregulation in U.S. cybersecurity policies by 2025. This approach, focused on reducing federal oversight, brings significant implications for federal and state-level laws, alongside how businesses manage compliance and maintain cybersecurity standards.
   
   
2. The future of the American Privacy Rights Act (APRA), proposed as a federal framework to unify data privacy standards, is now uncertain. The administration’s preference for minimising regulations may stall or revise the act, likely scaling back its focus on consumer rights and stringent compliance requirements. This could leave businesses navigating a fragmented landscape with varying state-level laws instead of a consistent federal standard. While federal advances may slow, state-level momentum continues. States like New Jersey, Tennessee, and Minnesota are developing comprehensive data privacy laws that emphasise data transparency, risk assessments, and consumer protection. However, these efforts could clash with federal priorities for streamlined regulations. Businesses may face differing compliance expectations depending on the states they operate in, adding complexity to nationwide operations. A key feature of the administration’s policy is likely deregulation, targeting existing cybersecurity mandates to reduce compliance burdens on businesses. This could mean relaxed reporting deadlines, fewer audit requirements, and greater flexibility for organizations, particularly benefiting small-to-medium enterprises. Yet, a lighter regulatory touch could also weaken baseline cybersecurity standards, increasing the risk of breaches and inconsistent protections across industries.
   
   
3. Europe: The EU continues to refine its data protection framework with the introduction of the Data Act and the Cyber Resilience Act, focusing on cybersecurity and data management. The EU is also enhancing regulations around AI and children’s privacy. Additionally, financial organisations and third party tech providers will be expected to be fully compliant to the Digital Operational Resilience Act (DORA) by January 2025.
   
   
4. Asia: Countries like Vietnam, Malaysia, and Indonesia are updating their data protection laws. These include mandatory breach notifications, appointment of Data Protection Officers (DPOs), and enhanced penalties for non-compliance.
   
   
5. Middle East: Middle Eastern countries are actively enhancing their cybersecurity frameworks in anticipation of 2025. Key developments include:
   
   
6. Saudi Arabia’s Advanced Cyber Frameworks The Kingdom’s Communications, Space, and Technology Commission (CSTC) has introduced stringent regulations targeting service providers in the IT, communications, and postal sectors. These policies emphasise consumer data protection, network security, and incident reporting. Companies must adopt proactive risk management practices and ensure compliance with the updated standards to avoid penalties.UAE’s Comprehensive Cybersecurity Policies The UAE Cybersecurity Council is spearheading new initiatives targeting key areas like cloud computing security, IoT device protections, and cybersecurity operation centers. These frameworks aim to enhance digital trust while promoting technological innovation. Businesses will need to secure their data storage systems, safeguard interconnected devices, and demonstrate readiness to counter evolving cyber threats.Broader Regional Efforts Other nations, including Oman, Qatar, and Jordan, are actively updating their cybersecurity regulations. These frameworks focus on strengthening legal obligations for organizations handling sensitive data. Requirements include mandatory breach reporting, adherence to cross-border data transfer restrictions, and appointing Data Protection Officers (DPOs) to oversee compliance.IoT and Cloud Computing Priorities With the Middle East adopting IoT devices and cloud solutions at a rapid pace, governments are formulating specific policies to address the associated risks. Regulations will require device manufacturers and cloud providers to uphold security-by-design principles, ensuring that potential vulnerabilities are mitigated during the development stage.
   
   
7. Africa: Nations are developing data protection laws, with some like Nigeria and Tanzania already implementing new regulations. The Malabo Convention aims to harmonize data protection laws across the African Union.

Fines and Class-action Law Suits

Historically, regulations have struggled to keep pace with the swift evolution of cybercriminal tactics, creating vulnerabilities for both customers and employees. This gap has fuelled a surge in class-action lawsuits, now reaching a 13-year peak, as affected parties seek compensation for breach-related damages. Looking ahead to 2025, the incidence of such lawsuits is anticipated to become a more pressing issue for businesses. This trend is driven by the increasing sophistication of cyber threats, which heightens the risk of breaches and subsequent legal challenges.

As consumers and employees become more informed about their rights and the possibility of legal recourse, the propensity to pursue class-action lawsuits grows. If regulatory measures fail to match the threat landscape, individuals are more likely to turn to the courts for justice, further amplifying this trend.

The financial impact of these lawsuits is considerable, compelling companies to prioritise investments in cybersecurity and strengthen their legal defences. Additionally, as legal precedents and frameworks develop through ongoing litigation, the path to successful lawsuits becomes more accessible. Consequently, businesses must proactively enhance their cybersecurity strategies and legal preparedness to reduce the risks and financial burdens associated with potential class-action suits.

Cyber Insurance

Cyber insurance will become an essential component of risk management strategies. As cyber threats become more prevalent, insurance providers will refine their offerings to cover a broader range of incidents. However, businesses must carefully assess their coverage to ensure it aligns with their specific risk profiles and potential exposures.

Regulators will also emphasise the importance of cybersecurity audits and assessments, requiring organisations to demonstrate their commitment to securing customer data and maintaining robust defenses. This increased scrutiny will drive improvements in cybersecurity practices across industries, fostering a culture of accountability and vigilance.

Insurance for CISOs and IT leaders will also become critical, not only as a key component of risk management strategies but also as a safeguard against personal liability. While Directors’ and officers’ (D&O) insurance liability exists, new professional liability insurance offerings tailored for CISOs, plus a cybersecurity trade union, care of The Security Industry Federation (SIF), will enable leaders to better protect themselves from personal financial losses arising from lawsuits tied to breaches or security incidents.

This type of coverage offers a vital layer of security, allowing CISOs to focus on lowering cyber risks without the added fear of personal repercussions. Those who leverage such insurance strategically will also be able to demonstrate a proactive stance on cybersecurity, which can significantly enhance their market reputation. By reducing potential damages and showing commitment to safeguarding both data and leadership, organisations will be able to build greater customer trust and loyalty, setting themselves apart in an increasingly security-conscious world.

Useful resources include:

• The Professional Association of CISOs at https://theciso.org/membership/.
• SIF at https://sif.org.uk/
• Cyber Future Foundation at https://cyberfuturefoundation.org

Workforce

The cybersecurity field in 2025 faces a complex interplay of challenges, from a shifting skills gap to intensifying burnout among professionals and the evolving role of the CISO. While some specialised roles continue to face talent shortages, automation and advancing technologies are leading to redundancies in others. To succeed now, cybersecurity professionals must demonstrate unique, irreplaceable value—offering skills and insights that machines cannot replicate. Adaptability has become paramount, with an emphasis on possessing the right skills to manage emerging threats and complex regulations in a rapidly evolving landscape.

These pressures are particularly acute for CISOs, whose roles are transitioning into broader integrated risk management positions, increasingly overlapping with the responsibilities of Chief Information Officers (CIOs). This convergence requires CISOs to go beyond traditional security practices and prove their business value. Failure to do so could render them redundant, prompting many to consider transitioning into roles as virtual CISOs (vCISOs) or CSO consultants to balance escalating responsibilities and accountability.

The burden on CISOs is immense, encapsulated by SolarWinds CISO Tim Brown’s remark, “We’ve been hearing CISO is the ‘chief scapegoat officer,’ right?” This sentiment underscores the growing scrutiny on these professionals, worsened by high-profile cases, such as the U.S. Securities and Exchange Commission’s lawsuit against SolarWinds and Uber, which spotlight the personal risks involved.

Meanwhile, across the broader cybersecurity landscape, burnout is becoming a critical concern as security teams grapple with relentless workloads and the emotional strain of high-stakes responsibilities. AI-driven tools are poised to ease these burdens by automating routine tasks, streamlining incident responses, and reducing false positives, offering professionals much-needed relief. However, technology alone is not enough. Organisations must prioritise work-life balance, providing mental health resources, and creating supportive, collaborative work environments to retain talent and maintain resilience. For CISOs and cybersecurity experts alike, aligning security with broader business objectives and investing in holistic well-being strategies will be essential to thriving in the high-pressure years ahead.

Growth Markets

The cybersecurity global skills shortage is a major factor driving investment in the security services market (security consulting services, security professional services and managed security services) which is expected to grow faster than the other security segments in 2025.

The rising sophistication of cyberattacks has heightened the demand for AI-powered threat detection and automated incident response solutions with research showing that companies leveraging these tools to prevent data breaches save an average of $2.22 million annually compared to those that don’t.

Similarly, as businesses continue their migration to cloud environments, robust cloud security solutions are becoming essential to protect sensitive data and workloads. With the proliferation of IoT devices across industries like healthcare, manufacturing, and smart cities, IoT security is also emerging as a critical area, designed to safeguard vast networks of connected devices from vulnerabilities.

Certain industries and markets are expected to drive cybersecurity innovation through 2025. These include healthcare, where safeguarding patient data against attacks like ransomware will remain critical, and finance, where protecting against state-sponsored intrusions and fraud becomes paramount.

Emerging markets like green technology and electric grids will also demand robust protections as they become key targets due to their essential role in addressing global energy needs. Furthermore, small-to-medium-sized businesses, often part of supply chains, will likely invest more in affordable, scalable cybersecurity solutions as they become increasingly targeted. Some analysts are predicting a focused market move from large USA enterprises to Europe SMEs.

The Road Ahead

The cybersecurity landscape of 2025 will be shaped by the convergence of challenges and opportunities. Organisations and their leaders must prioritise resilience through robust identity protection, proactive approaches leveraging AI, adherence to evolving regulations, and investment in workforce development. Collaboration, innovation, and foresight will be essential for surviving and thriving in this rapidly shifting environment. Businesses that adapt to and anticipate these changes will not only mitigate risk but position themselves as leaders in the new era of cybersecurity.

Now I want to hear from you…

Tell me where you see the market going next year? What am I missing. Join in the conversation on LinkedIn, here.

By Jane Frankland (Business Owner & CEO, KnewStart)

Original link of post is here

Welcome to the Challenge: Governance, Risk & Security

A CISO’s world is never just about technology. It’s about governance, risk, and control. Without governance, security becomes a guessing game. Without risk management, threats remain unseen. A 30-60-90 day plan is the key to balancing it all. Let’s dive in.

First 30 Days: Establishing Governance & Understanding Risk

1. Governance: The Foundation of Security

A lack of governance is a risk in itself.

• Start at the top. Board members and senior executives set the tone.
• Establish an advisory committee. Business leaders need a say in security.
• Define security’s role in IT strategy. If IT moves, security moves with it.

2. Prioritize Risk Management

Security is about controlling risk, not eliminating it.

• Identify risk appetite. What’s an acceptable loss? Ask the CFO.
• Use a framework. NIST, ISO, COBIT—pick one and stick to it.
• Map risks to business impact. Not all threats need the same response.

3. Streamline Security Requests

Security must move at business speed.

• Fix firewall bottlenecks. If IT controls the firewall, ensure security has a say.
• Prioritize security projects. Delayed security is a vulnerability.
• Understand approval processes. Know how to get projects funded and prioritized.

By the end of this phase, governance should be defined, risk appetite clear, and security positioned as a business enabler.

Day 31-60: Implementing Controls & Enhancing Visibility

4. Define & Enforce Security Frameworks

Frameworks provide structure and accountability.

• Choose a primary framework. NIST, ISO, or COBIT are common choices.
• Standardize policies. Align controls with business operations.
• Ensure compliance integration. Security must fit into audit, legal, and regulatory needs.

5. Validate Security Tools & Justify Technology

Security tools should serve a purpose—not just exist.

• Review existing technology. Every 18 months, ask, “Is this still the best option?”
• Evaluate alternatives. Challenge vendors to stay competitive.
• Automate where possible. AI and analytics can reduce manual workload.

6. Align Training with Business Needs

Security teams must keep up with evolving threats.

• Mandate training. Five days of training per person every 90 days.
• Encourage cross-training. No single points of failure.
• Invest in certifications. Cloud, risk, and compliance skills are critical.

By the end of this phase, security controls should be aligned with business needs, tools should be justified, and staff should be continuously improving.

Day 61-90: Maturity, Automation & Continuous Improvement

7. Governance Committees: Keep Security in the Loop

Security decisions need leadership buy-in.

• Join audit and risk committees. Security must be part of corporate governance.
• Engage in IT strategy discussions. Security can’t be an afterthought.
• Ensure compliance reporting is proactive. Don’t wait for audits to find gaps.

8. Continuous Security Improvement

Security isn’t static. It evolves.

• Schedule vulnerability scans daily. Don’t wait for a breach to find weaknesses.
• Monitor technology roadmaps. Know when your tools are becoming obsolete.
• Refine security metrics. Measure effectiveness, not just activity.

9. Secure the Development Lifecycle

Code security matters just as much as network security.

• Implement code reviews. Security should be part of development, not an afterthought.
• Use automated security testing. Catch vulnerabilities early.
• Adopt secure coding standards. Reduce risk before deployment.

By the end of 90 days, governance should be strong, risk should be managed, and security should be woven into business operations.

The Future: Staying Ahead of Threats

Cybersecurity doesn’t stop at 90 days. It’s an ongoing cycle.

• Monitor, refine, repeat. Governance and security must adapt to business changes.
• Justify security investments. Keep proving the value of security initiatives.
• Train relentlessly. Technology evolves fast—your team must evolve faster.

With a structured 30-60-90 day plan, CISOs can build a security function that’s resilient, responsive, and ready for anything. Now, go secure the enterprise.

Join CISO Platform — the CyberSecurity Community
Gain exclusive insights from top security professionals and access cutting-edge research.
Join Now

By: Gordon Rudd (Cheif Executive Officer, Stone Creek Coaching)

After a long, long, long writing effort … eh … break, we are ready with our 5th Deloitte and Google Cloud Future of the SOC paper “Future of SOC: Transform the ‘How’.”

As a reminder (and I promise you do need it; it has been years…), the previous 4 papers are:

• “New Paper: “Future of the SOC: Evolution or Optimization — Choose Your Path” (Paper 4 of 4.5)” [please consider rereading this before reading the new one!]
• “New Paper: “Future Of The SOC: Process Consistency and Creativity: a Delicate Balance” (Paper 3 of 4)”
• “New Paper: “Future of the SOC: SOC People — Skills, Not Tiers” (Paper 2 of 4)”
• “New Paper: “Future of the SOC: Forces shaping modern security operations” (Paper 1 of 4)”

When facing the question of whether to evolve or optimize a Security Operations Center (SOC), security leaders have numerous risks and rewards to consider. Disruptions to normal operations, migration challenges, compatibility issues, advantages of new technologies, and learning curves for the teams involved are many important factors to consider.

Previously in our “Future of the SOC” series, we explored the conditions in which security leaders could transform SOC tools and practices vs conditions in which leaders could double down and improve their existing tooling and ways. Specifically, in our “Future of the SOC: Evolution or Optimization — Choose Your Path,” we laid out a decision matrix to help navigate the decision on whether to change or stay.

However, when we wrote the previous paper, lots of people asked us: OK, we ran through the process and the process led us to the need to transform (rather than optimize) our SOC. How do we go about it? Are there boosters or amplifiers for this? Are there related projects you can latch on, as this whole transformation business is just hard? This is exactly what we cover here in our current paper.

Specifically, we explore the change decision tree through the lens of three common scenarios as drivers for transformation: Cloud migration, Managed Detection and Response (MDR) adoption, and DevOps evolution.

Future of SOC paper 4.5

My favorite quotes:

• “As organizations migrate to the cloud, there’s a notable shift from endpoint-centric security models to a broader focus on data correlation and aggregation facilitated by SIEM and SOAR technologies. This shift is crucial for adapting to the dynamic, distributed nature of cloud environments and for effectively managing the increased complexity and profusion of security data. ” [A.C. — in less polite terms, “EDR-huggers” need to either push their EDR vendors to do real, not-endpoint-centric Cloud D&R or stop hugging…]
  
  
• ‘Shadow operations teams: Observe the incumbent service providers’ operations teams and/or the Customer Operations team in their day-to-day activities to understand and document lessons learned, known issues, exception scenarios, priorities, and dependencies” [A.C. — in this MDR-centric transformation the point is actually … getting better by learning from them, not doing the “four letter o” word … “outsourcing” :-) ]
  
• “The main challenge is that when the IT counterpart to security is much faster (hours vs. months, in some cases), security needs to “speed up or shut up.” Agile IT with 1990s-style slow security will fight, and the modern approach (IT) will normally win… putting the organization at risk.” [A.C. — never bet against inertia in large enterprise IT!]
  
  
• “A modern SOC should be an integral part of the DevOps ecosystem. It should prioritize speed, automation, and a mindset that treats security as an essential component of the development process from the outset. ” [A.C. — this sounds cliche, but security should not fight DevOps, but learn and adopt from it]

The paper is full of gems that go far beyond these quotes. Go and read it, but do consider rereading the previous paper before doing to.

Related blog posts:

• “New Paper: “Future of the SOC: Evolution or Optimization — Choose Your Path” (Paper 4 of 4.5)”
• Video version of this (slides)
• “New Paper: “Future Of The SOC: Process Consistency and Creativity: a Delicate Balance” (Paper 3 of 4)”
• “New Paper: “Future of the SOC: Forces shaping modern security operations””
• “New Paper: “Future of the SOC: SOC People — Skills, Not Tiers””
• “New Paper: “Autonomic Security Operations — 10X Transformation of the Security Operations Center”
• WTH is Modern SOC, Part 1
• Baby ASO: A Minimal Viable Transformation for Your SOC
• Original ASO paper (2021)

- By Anton Chuvakin (Ex-Gartner VP Research; Head Security Google Cloud)

Original link of post is here

My former “colleagues” have written several serious pieces of research about why a SOC without humans will never happen (“Predict 2025: There Will Never Be an Autonomous SOC”, “The “Autonomous SOC” Is A Pipe Dream”, “Stop Trying To Take Humans Out Of Security Operations”). But I wanted to write a funny companion to this called “How to Talk to Idiots Who Believe in ‘Humanless SOC’.” Here it is, but it is definitely a rant and not technical guidance, mind you.

I think most of us will encounter people who believe that a Security Operations Center (SOC) fully staffed by machines and with no humans anywhere will actually happen. Now, I think those people are delusional, but it is interesting to try to study those delusions. Try to psychoanalyze them, perhaps. Maybe this points to some suppressed childhood trauma, I dunno…

Years ago, I had an old and wise mentor who explained everything weird in the (human) universe by a unique (for each occurrence) blend of two forces: corruption and stupidity. Perhaps this can be applied here? Some may believe this out of ignorance (see more on this below) while others choose to believe it because their VC funding depends on it…

Anyhow, let’s look at the extreme fringe of a fringe. You may meet people who think that artificial intelligence today is so advanced that human presence inside the SOC is not necessary. Today! They actually think AI can already replace all humans in a SOC! Some of them even have a demo ready, powered by … ahem … “a demo-ready AI” that works — you guessed it! — in a demo. Sadly, it will never deliver even a tiny fraction of the promised benefits once confronted with a real-world, messy environments full of outdated systems, API-less data stores, tribal knowledge, junior IT people, and sprinkled with human incompetence…

Similarly, some people have never seen how a large enterprise functions, so they make assumptions about automation possibilities that are just wildly off. They struggle to grasp the complexity of a “typical” (ha! as if!) enterprise “layered cake” environment, with its layers of technology ranging from 1970s mainframes to modern serverless and gen AI systems.

To elaborate on the lack of enterprise environment knowledge, what makes it even worse is common reliance on tribal knowledge of unique systems — knowledge that only exists in the minds of specific individuals. It’s very difficult, if not impossible, for any automated system (whether AI-powered or not) to make decisions based on context that simply isn’t present in computers…

In other cases, an utter lack of understanding of how modern (and especially not-so-modern) security operations centers, and detection and response teams operate comes up. Some snakeoil sellers of “humanless SOC’” rely on things like ”this needs a current asset list, we will just query CMDB or Attack Surface Manager.” Ah, a CMDB that was last updated in 2008, and an ASM that covers a third of the environment … suuure. They often promise (or, worse: ask the customer to!) to “fix these issues before deployment,” failing to acknowledge that some of these issues have persisted for decades. “Decades, Karl!” That’s like 10+ years! :-)

Yet another category of people believe in a humanless SOC based on their complete lack of understanding of threats. In fact, they shift their AI so far right (“AI SOC = better alert triage”), and neglect bad detection content altogether… And, yes, threat actors sometimes know the environment better than the defenders do. I’m optimistic that in the long term, with the wider adoption of cloud computing, the occasional attacker advantage will vanish. Defenders will collect more data on their environments and be able to keep it updated (well, I can hope, can I?) Today, however, it is just not the case.

Now, what about trying to match the quality of a bad SOC, like one run by a low-end MSSP vendor? As I alluded before, artificial intelligence today seems close to matching the quality of a bad SOC without any humans. To this, I add: If you lower the bar enough, you can match the quality of a bad SOC even without AI. Just connect your SIEM alerts to an alert distribution mechanism like email. Done! You have a really, really, really, really bad SOC, and without any humans. And without AI too!

So using this argument (“I can replicate a really bad SOC with AI”) is essentially cheating (more seriously, if one can replicate a “mediocre+” MDR but without any human “butts in seats”, this can be a decent business!)

Finally, there is one delusion that’s actually worthy of deeper analysis: the belief that AI will soon advance so rapidly and so massively that it will replace all humans in the SOC. Let’s not turn this into “are LLM a path to AGI?”; actual AI experts can debate this one. We will focus on the SOC.

Let’s start this discussion with good news. Several years ago (2021), I was a long-term optimist, but a short-term skeptic about AI in security. Now, I’m even more optimistic in the long term and cautiously optimistic in the short term. Despite my optimism, I don’t see a short-to-medium-term trajectory for AI that would lead to a humanless SOC. I do see a lot of AI use in the SOC, to be sure, but a SOC run by humans!

Notably, when we developed Autonomic Security Operations (ASO), we stressed that humans are central to modern security operations (as they are with our own D&R capabilities). We also mentioned the many tools used in such operations, including of course AI.

Where can you go from here? We can discuss what’s possible, and increased automation of your security operations center is definitely on that list. We can also explore the potential pathways that might eventually (EVENTUALLT!) lead to a humanless SOC. However, this is the world of tomorrow…

… and we are back to today!

Here are my Top Reasons Why a SOC Without Humans Will Not Happen:

1. Tribal Knowledge: Crucial knowledge for alert triage, investigation and detection authoring often exists only in someone’s head, not in any automated or even any digital system (you gen AI “agent” may read the pages of an analog notebook, to be sure, but a human is needed to shove said notebook in front of a robot’s all-seeing-eye…)
2. Adaptable Attackers: Creative attackers will continue to outsmart automated (including gen AI — powered) defenses, as they possess the ingenuity and adaptability that machines currently lack (this argument very much applies to short-to-medium term and I make no promises for long term, mind you, AGI FTW … but LATER!)
3. Security Data Quality: Many AI projects are limited by the quality of their data. Building an excellent “AI SOC” requires vast amounts of high-quality data, which is often unavailable, and this is doubly so for company-specific data (we can debate how attack-surface-agnostic you can make this in later blogs…)

These are just a few of the main reasons why a fully automated (humanless, fully autonomous, etc) SOC is not feasible in the near future. If you encounter someone who believes in this fallacy, remind them of the importance of tribal knowledge, expert intuition, attacker adaptability, and the limitations of current AI technology due to insufficient data quality. These challenges remain largely insurmountable, even with projected technological advancements.

Finally…

A critical challenge in writing this blog is my unwavering belief in the relentless pursuit of automation within a detection and response domain. Ideas like ASO (and its origins) have demonstrated that an engineering mentality and a drive to automate more activities are crucial for building a modern SOC. In fact, SRE’s job is to “automate yourself out of your job”, but here lies a paradox: humans are needed to automate humans out of a human job, yet this loop is endless…

Related posts:

• Baby ASO: A Minimal Viable Transformation for Your SOC
• Anton’s Alert Fatigue: The Study
• New Paper: “Future of SOC: Transform the ‘How’” (Paper 5)

- By Anton Chuvakin (Ex-Gartner VP Research; Head Security Google Cloud)

Original link of post is here

This is my completely informal, uncertified, unreviewed and otherwise completely unofficial blog inspired by my reading of our next Threat Horizons Report, #11 (full version) that we just released (the official blog for #1 report, my unofficial blogs for #2, #3, #4, #5, #6, #7, #8, #9 and #10).

My favorite quotes from the report follow below:

• “Nearly half (46.4%) of the observed security alerts were due to overprivileged service accounts. ” [A.C. — using new data on cloud detections, we confirmed an old hypothesis: if you overprovision, you suffer. Very cause->effect: overprovision -> suffer!]

• “During H2 2024, credential-related vulnerabilities like weak or no passwords continued to be the most common entry point for attackers as shown [below], though the frequency decreased slightly through 2024. Misconfiguration of cloud environments (services or software) remained a significant security gap.” [A.C. As I said in other THR blogs, the main news here is that there is no news; a lot of cloud security problems in 2025 are 2020 problems, at best. Initial access vectors didn’t change all that much. “Secure by default” seems to apply to new cloud deployments perhaps and having no effect on what is running today …]
• “We also observed a new trend in the second half of 2024: a sharp rise in compromised APIs and UIs due to threat actor targeting. These attacks accounted for 17.1% of observed incidents, a substantial increase from the approximately 13% observed in the first half of 2024. “ [A.C. — aha, something DOES change! Perhaps all that endless whining of those ‘“API security vendors” had an effect and attackers are finally interested :-)]

• “We also saw a significant trend in threat actors searching for insecure private keys (13.7%), reinforcing the need for organizations to prioritize the security and proper management of private keys.” [A.C. — next time, somebody asks you in the dark cloud alley “do you even lateral, dude?”, you go “PRIVATE KEY SEARCH!!!”]
• “More than half (62.2%) of threat actor movements once they gained access involved attempting lateral movement within an environment and downloading tools designed for this purpose.” [A.C. — not sure what happened to cryptomining, I think we fixed it…]

• “Identity compromise is no longer limited to password theft based upon misconfigurations or weak passwords. Threat actors are now gaining access by intercepting or stealing post-authenticated tokens or cookies, effectively bypassing traditional authentication criteria. ” [A.C. — while I am still not a fan of ITDR as a separate tool, it is very clear that we are still under-equipped to fight this one…]
• “The most common methods of identity compromise include brute-forcing using common/guessable passwords, replaying stolen credentials from a previous breach, credential stuffing, phishing, and social engineering.” [A.C. — in other words, a range of 1970s-2020s tactics and methods ;-) And, yes, well-crafted MFA helps against many of these, but not all]
• “Threat actors are increasingly targeting identities and databases, exploiting misconfigurations and vulnerabilities to gain access to sensitive information and resources. Insecure databases containing critical business data and personally identifiable information (PII) are particularly attractive targets.” [A.C. — I am going to channel Captain Obvious here, but can you imagine? Corporate databases contain valuable data! No way, right? And somebody will steal it if you don’t secure it….]
• “To take over cloud service accounts, TRIPLESTRENGTH leverages stolen credentials and cookies, at least a portion of which have come from Racoon infostealer logs, to gain access to victim cloud environments.” [A.C. — a fun example re: cookies!]
• “Mandiant has observed threat actors increasingly extorting victim organizations by exposing their stolen data on Data Leak Sites (DLS). […] The expanded use of these extortion tactics combined with the prevalence of DLS poses a growing threat for all organizations, regardless of where their data is stored.” [A.C. — kinda makes sense, I suspect [gut, not data!] that “encrypt only” was easier on-prem, whole “encrypt+steal and post” works in the cloud]

Now, go and read the THR 11 report!

P.S. Coming soon! Trend analysis of THR1–11!

Related posts:

• EP112 Threat Horizons — How Google Does Threat Intelligence podcast
• Google Cloud Security Threat Horizons Report #10 Is Out!
• Google Cybersecurity Action Team Threat Horizons Report #9 Is Out!
• Google Cybersecurity Action Team Threat Horizons Report #8 Is Out!
• Google Cybersecurity Action Team Threat Horizons Report #7 Is Out!
• Google Cybersecurity Action Team Threat Horizons Report #6 Is Out!
• Google Cybersecurity Action Team Threat Horizons Report #5 Is Out!
• Google Cybersecurity Action Team Threat Horizons Report #4 Is Out!
• Google Cybersecurity Action Team Threat Horizons Report #3 Is Out!
• Google Cybersecurity Action Team Threat Horizons Report #2 Is Out!
• Illicit coin mining, ransomware, APTs target cloud users in first Google
• Cybersecurity Action Team Threat Horizons report

- By Anton Chuvakin (Ex-Gartner VP Research; Head Security Google Cloud)

Original link of post is here

Imagine walking into a crowded airport where security checks every bag. Some bags trigger an alert and are flagged. Security pauses and asks: “Is this dangerous or just an innocent traveler carrying metal in their pockets?” Now, picture this in the digital world. Every web request is like a passenger, and anomaly scoring in ModSecurity Core Rule Set (CRS) is the sharp-eyed security guard deciding what goes through and what gets stopped.

What Is Anomaly Scoring?

Most Web Application Firewalls (WAFs) act like traffic lights. They give a simple go or stop. Good traffic passes, and bad traffic gets blocked. But anomaly scoring changes the game. Instead of saying “block” or “allow” based on one rule, it looks at everything happening.

• Every detection rule adds a score.
  
  
• Higher scores mean more suspicious activity.
  
  
• Once the score crosses a threshold, action is taken.
  
  

Why This Matters

Blocking or allowing traffic based on one event is risky. False positives pile up. The system gets overwhelmed. The result? Legitimate requests get flagged, and attackers sneak through. Anomaly scoring adds layers. It looks at multiple signals before deciding. This makes it easier to manage false positives while keeping the bad guys out.

Breaking Down the Anomaly Scoring Process

Here’s how it unfolds:

1. Detection Before Blocking

Anomaly scoring separates detection from blocking. It gives time to analyze before stopping traffic. Hundreds of rules inspect requests and assign scores.

• SQL injections? +5 points.
  
  
• XSS attempts? Another +5.
  
  
• More hits? The score goes up.
  
  

2. Threshold Control

Each request starts at zero. As suspicious activity is detected, the score builds. Once it crosses a defined threshold (let’s say 15), ModSecurity decides whether to block or allow it.

• Below threshold: Pass.
  
  
• Above threshold: Block.
  
  

The False Positive Problem

Here’s where things get tricky. When moving to production, many choose to start in monitoring mode. It’s like watching traffic but not stopping anything. This helps catch false positives. But when those pile up? It’s overwhelming. Imagine sorting through 100,000 alerts just to figure out what's real.

Anomaly scoring solves this. It lets security teams refine and fine-tune thresholds without blocking legitimate traffic.

A Smarter Way to Fine-Tune Security

1. Start High, Lower Gradually

Think of anomaly scoring like adjusting the volume on a speaker. You don’t start with it blaring at full blast.

• Day 1: Start at a very high threshold—say 10,000.
  
  
• Slowly reduce it over time, perhaps to 100.
  
  
• Each step reveals patterns and reduces false positives.
  
  

2. Iterative Tuning

With every iteration, it’s easier to see the troublemakers. Fine-tuning means looking at requests scoring 100 or higher, analyzing what triggered them, and adjusting accordingly.

3. Reduce Thresholds in Phases

Drop the threshold step by step:

• From 10,000 to 100.
  
  
• From 100 to 50.
  
  
• Gradually, down to 5.
  
  

At 20, real security kicks in. Real attacks get blocked while false positives drop.

The Power of Small Wins

Every time the threshold drops, more false positives disappear. By focusing on the highest-scoring requests, the team clears the noise.

• 80% of false positives get handled in the first iteration.
  
  
• By the time the threshold hits 20, critical attacks are blocked.
  
  

Trust Through Iteration

Anomaly scoring isn’t just about blocking attacks. It’s about building confidence in your system. Step by step, thresholds lower, but the system stays stable. Nobody calls the helpdesk screaming about broken forms or blocked registrations.

• Iteration 1: Big wins.
  
  
• Iteration 2: Sharper controls.
  
  
• Iteration 3: Real security with fewer false alarms.
  
  

Why Anomaly Scoring Is a Game-Changer

1. Flexibility in Production

You’re not guessing. The system learns as it goes. Traffic is analyzed, refined, and adjusted to protect real users without breaking functionality.

2. Lower Risk, Higher Accuracy

False positives go down. Real attacks get caught. Everyone wins.

3. Human-Centric Approach

Instead of relying solely on machines, anomaly scoring empowers security teams to fine-tune and iterate over time.

Getting to the Finish Line

The goal? A crisp, sharp system where one bad request triggers a block. The path to get there isn’t immediate but careful and measured. It takes about 4-6 iterations before reaching this optimal state.

• Confidence grows with every phase.
  
  
• False positives shrink.
  
  
• The system becomes an invisible shield, protecting without interfering.
  
  

Final Thoughts

Anomaly scoring is not magic. It’s a well-defined, practical approach to securing web applications. By analyzing requests, assigning scores, and adjusting thresholds gradually, organizations gain better protection without upsetting users.

So, next time you think about web application security, remember: it’s not just about stopping the bad. It’s about learning, adjusting, and growing stronger—just like anomaly scoring does, step by step.

Join CISO Platform — the CyberSecurity Community
Gain exclusive insights from top security professionals and access cutting-edge research.
Join Now

By: Christian Folini (Teacher and Security Engineer, Partner, Netnea.com)

Imagine walking down a busy street where pickpockets are lurking. You wouldn't flash your wallet, right? Instead, you'd zip it away, staying one step ahead. That's exactly what the OWASP ModSecurity Core Rule Set (CRS) does for your web applications—silently shielding them from opportunistic attacks before they can strike.

What is OWASP and Why Should You Care?

OWASP (Open Web Application Security Project) is like the neighborhood watch for web applications. You’ve likely heard of their famous OWASP Top 10—a list of the most common security risks plaguing web apps. But OWASP is much more than that. Among its flagship projects, one stands out as a silent guardian—ModSecurity CRS.

CRS is a set of security rules that works like an intelligent shield. It's not the silver bullet, but it does the heavy lifting. CRS blocks common exploits so that you can focus on the bigger threats that really demand your attention.

Why ModSecurity CRS Matters

Picture a burglar trying different locks to break into a house. CRS makes sure those locks are too tough to crack. It works by blocking attacks before they even touch your application. This is what security pros call “security in depth.”

CRS in Action:

• Stops generic exploits before they reach the application.
  
  
• Hides application weaknesses from casual attackers.
  
  
• Protects against SQL injections, XSS, and other dangerous exploits.
  
  

CRS protects over 100 terabits of traffic per second globally. That’s a lot of bad traffic being kept at bay.

CRS 3: Reviving and Simplifying Security

CRS has been around for nearly 15 years. But let’s be honest—earlier versions weren’t exactly user-friendly. Documentation was sparse, guides were missing, and running it felt like piloting a spaceship without training.

When CRS 3 launched, everything changed.

What’s New in CRS 3?

• Better Documentation: Clearer tutorials, improved integration guides.
  
  
• Easier Setup: A five-minute installation that gets you started quickly.
  
  
• Fewer False Alarms: False positives were reduced by over 95%.
  
  
• Drupal Compatibility: CRS 3 works seamlessly with platforms like Drupal and others.
  
  

How CRS Protects You: Blocking 80% of Known Vulnerabilities

You wouldn’t trust a door lock that fails half the time. CRS doesn't disappoint. Research conducted at the Surik University for Applied Sciences proved this. A security researcher tested CRS with Burp Suite—a tool loaded with aggressive plugins designed to identify vulnerabilities.

The Results?

• Burp fired 4.5 million requests at a vulnerable application.
  
  
• It discovered over 1,000 weaknesses.
  
  
• With CRS 3 in place, 80% of those weaknesses were rendered useless.
  
  

Let’s break it down:

•  SQL Injection: 100% blocked.
  
  
•  Local File Inclusions: Completely neutralized.
  
  
•  Cross-Site Scripting (XSS): Reduced by over 80%.
  
  

Paranoia Levels: Customizing Security for Your Needs

Security is never one-size-fits-all. That's where Paranoia Levels come in. Think of it like adjusting the sensitivity of a car alarm.

• Paranoia Level 1 (PL1): Default and least intrusive. Minimal false positives.
  
  
• Paranoia Level 2 (PL2): Stricter rules, detecting more attacks. Occasional false positives.
  
  
• Paranoia Level 3 (PL3): High alert. Excellent at catching subtle attacks but prone to false positives.
  
  
• Paranoia Level 4 (PL4): Maximum sensitivity. Great for advanced threat detection, but with higher performance costs.
  
  

Each level adds layers of protection. Higher paranoia levels enable more rules, detecting advanced threats but may occasionally mistake friendly requests for attacks.

False Positives: Keeping It Real

False positives are like your smoke alarm going off when you’re cooking dinner. Annoying, but better than a real fire. CRS minimizes false positives by fine-tuning its rule set. And if one slips through? Rule exclusions let you tweak CRS to ignore specific requests that trigger false alarms.

Strongest Areas of Protection

CRS excels in several key areas. Some of its best tricks include:

• SQL Injection (SQLi): Completely neutralized.
  
  
• Local File Inclusion (LFI): Blocks attempts to access sensitive files.
  
  
•  Cross-Site Scripting (XSS): Catches over 80% of attacks.
  
  
•  Remote Command Execution (RCE): Safeguards against command injections.
  
  

Where CRS Could Be Better

No tool is perfect. Redirect attacks and remote file inclusions (RFI) are harder to block. These types of attacks often involve redirecting users to malicious sites. Since there are countless malicious domains, CRS can’t possibly track them all.

To defend against these threats, allow lists are your best friend. Defining which hostnames are acceptable helps block unwanted redirects.

Advanced Threats? Meet Paranoia Level 3 and Beyond

For organizations facing targeted attacks, Paranoia Level 3 (PL3) and Paranoia Level 4 (PL4) are the go-to choices. These levels offer enhanced detection of advanced threats, but with a tradeoff—higher false positives and increased performance costs.

• PL3: Adds specialized rules for complex threats.
  
  
• PL4: Leaves no stone unturned but requires extra vigilance to manage false positives.
  
  

CRS in the Real World: Blocking Millions of Attacks

Think about the last time you clicked a suspicious link and your browser stopped you. That’s CRS, but working silently in the background. Whether it's a SQL injection, a cross-site scripting attempt, or someone trying to retrieve your server’s password file—CRS has your back.

Why You Need ModSecurity CRS

Cyber threats don’t take days off. Neither should your security. CRS acts as the perfect security guard, ensuring your web applications stay safe from the usual suspects.

What ModSecurity CRS Offers:

•  Quick Installation: Up and running in five minutes.
  
  
•  Minimal False Positives: Weed out 95% of false alarms.
  
  
•  Paranoia Level Flexibility: Choose the right level based on your needs.
  
  
•  Protection Against Core Threats: SQLi, XSS, LFI, and more.
  
  

Final Thoughts: Security That Adapts to You

Web applications are constantly evolving. Attackers are getting smarter. But with OWASP ModSecurity CRS, your defenses evolve too. It doesn’t just protect you—it gives you the freedom to focus on building and growing without constantly looking over your shoulder.

CRS isn't a magic bullet, but it’s pretty close. And in the ever-changing world of cybersecurity, that’s a win worth taking.

Join CISO Platform — the CyberSecurity Community
Gain exclusive insights from top security professionals and access cutting-edge research.
Join Now

By: Christian Folini (Teacher and Security Engineer, Partner, Netnea.com)

What is Mod Security?

Imagine an old mechanical watch. Tiny gears, springs, and screws work together. No fancy AI, no wireless updates—just pure engineering. Mod Security works the same way. It’s not flashy. It doesn’t rely on cloud intelligence or machine learning. It sticks to what it knows—patterns, rules, and a solid decision-making process.

When a web request hits, Mod Security looks at it and asks, “Friend or foe?” If it smells trouble, it blocks the request. If it’s safe, it lets it through. Simple, but powerful.

How Does Mod Security Work?

Think of Mod Security as a detective. It doesn’t guess. It examines HTTP requests against a set of known rules. If something looks suspicious, it takes action.

Unlike modern Web Application Firewalls (WAFs) that connect to the cloud and ask for advice, Mod Security works independently. It makes decisions on its own, based on pre-existing patterns that you can tweak. This gives you full control over what goes in and what stays out.

Embedded in Your Web Server

The name says it all. Mod Security is a mod—a module that lives inside your web server. Traditionally, it was paired with Apache, the trusty workhorse of web servers. It was born out of necessity in 2002, when Ivan Ristic developed the first version. Businesses were growing online, and the need to secure web applications became critical.

Soon after, Mod Security caught on like wildfire. By 2005, the community was buzzing, and in 2007, Trustwave took over its development. Fast forward a decade, and Mod Security was no longer exclusive to Apache. It extended its reach to NGINX and IIS. But it wasn’t a smooth transition.

Mod Security’s Growing Pains

Here’s where things get tricky. Mod Security was originally built for Apache. When it moved to NGINX, things got… weird. To make Mod Security run on NGINX, it had to be “fooled” into thinking it was still running on Apache. It worked, but it wasn’t perfect. It was like fitting a square peg into a round hole.

To fix this, developers created Mod Security 3. It was supposed to be a game-changer. It separated Mod Security from the web server using a thin API connector. But there was a catch—Mod Security 3 works best with NGINX. Apache users were left with a gap, and many features from the older version didn’t make the cut.

Mod Security 2.9 vs. Mod Security 3: The Showdown

When comparing Mod Security 2.9 to 3, it’s like comparing a reliable old car with a flashy new model. Mod Security 3 is modern and sleek but has performance gaps and bugs. It’s still catching up.

• Detection Accuracy: Mod Security 2.9 detects 3-5% more test requests than version 3. This means version 2.9 is still the better choice for tight security.
  
  
• Performance: Apache with Mod Security 2.9 runs faster than NGINX with Mod Security 3. While NGINX is naturally faster, adding Mod Security slows it down more than Apache.
  
  
• Compatibility: Mod Security 3 struggles to work seamlessly with Apache due to the lack of a production-ready connector.
  
  

The Power of Rules: Fine-Tuning Security

Mod Security is only as smart as its rules. Think of it like a set of recipes. You can either use ready-made ones or create your own. Most security experts rely on the OWASP Core Rule Set (CRS)—a free, powerful collection of rules that protect against common threats.

These rules cover:

• SQL Injection
  
  
• Cross-Site Scripting (XSS)
  
  
• File Inclusion Attacks
  
  
• Malicious Payloads
  
  

With Mod Security, you can tweak these rules to match your environment perfectly. It’s like tuning a watch to keep perfect time.

Why Control Matters

Mod Security gives you granular control. You can dig into each request, inspect the tiniest details, and tweak the rules to perfection. While many commercial WAFs wrap Mod Security in fancy interfaces, this often strips away that deep control.

Graphical interfaces look good but limit customization. When you configure Mod Security from the command line, you get full access to its potential.

Mod Security’s Future: What Lies Ahead?

For now, Mod Security 2.9 remains the gold standard for Apache users. But change is coming. Mod Security 3, despite its gaps, is the future. As developers iron out the bugs and close the feature gaps, Mod Security 3 will eventually take over.

Until then, sticking with Mod Security 2.9 is a wise choice. It’s stable, reliable, and battle-tested.

Mod Security and OWASP CRS: A Perfect Match

The real power of Mod Security comes to life when paired with the OWASP Core Rule Set (CRS). This combination offers a solid defense against web application attacks. It’s like having an expert locksmith fine-tune your home security system.

Why Mod Security Still Matters

Even with all the advancements in cloud-based security, Mod Security remains a trusted ally for many organizations. It runs independently, provides fine-grained control, and offers protection against the most common web application attacks.

For security teams that value control and transparency, Mod Security is still the best bet. It’s not about bells and whistles. It’s about solid, dependable security that you can trust.

Final Thoughts

Mod Security may be old school, but sometimes, old school is exactly what you need. It’s reliable, predictable, and puts control back in your hands. For those who want to protect their web applications without relying on the cloud, Mod Security remains the go-to choice.

Like a well-tuned watch, Mod Security quietly does its job—keeping things running smoothly, one request at a time.

Join CISO Platform — the CyberSecurity Community
Gain exclusive insights from top security professionals and access cutting-edge research.
Join Now

By: Christian Folini (Teacher and Security Engineer, Partner, Netnea.com)

Imagine a busy highway. Cars zoom past, carrying everything from passengers to valuable goods. But not every vehicle should be allowed in. Some might carry dangerous cargo, while others are simply lost. Web Application Firewalls (WAFs) work the same way. They stand guard at the entrance of your web application, deciding who gets in and who stays out.

But just like traffic rules, WAFs can be tricky. They’re powerful, but they need the right configuration to do their job effectively.

Why WAFs Became a Necessity

Once upon a time, cybersecurity was simpler. Then came the PCI-DSS (Payment Card Industry Data Security Standard) in 2005. It mandated that organizations handling credit card information had to have a web application firewall. But here’s the twist—PCI-DSS never said you had to run it in blocking mode.

Just having a WAF was enough to meet compliance. Whether it actually protected anything was another story.

What Is a Web Application Firewall?

A WAF analyzes incoming HTTP traffic. It checks for patterns that look suspicious. When it detects a potential attack, it either blocks the request or lets it pass, depending on how it’s set up. Think of it like a border guard, scanning every vehicle and deciding which ones are safe to enter.

But here’s the catch—there’s no industry standard that defines what a WAF should be. Over the years, this led to the emergence of hundreds of WAF products, each with its own flavor.

A Crowded Market with No Common Ground

The WAF market exploded after PCI-DSS came into play. Vendors rushed to offer their version of a web application firewall. Some took existing security tools, added a few features, and rebranded them as WAFs.

Today, there are around 100 commercial WAFs on the market, each claiming to be the best. Gartner tracks a handful of the top ones in their periodic reports, but below that line, 50 to 80 more WAFs fight for a place in the spotlight. And guess what? The market is still fragmented, with no sign of consolidation.

ModSecurity: The Open-Source Champion

In this crowded market, ModSecurity stands out. It’s an open-source WAF running under an Apache license. It’s free, flexible, and widely adopted. Many commercial WAFs actually use ModSecurity under the hood, wrapping it with a polished interface and selling it as a premium product.

About half of the commercial WAFs on the market are built on ModSecurity. Some vendors are transparent about this, while others quietly package it as their own. But the core functionality often remains the same.

How WAFs Work: Traffic Inspection at Its Best

Picture a web application firewall as a security checkpoint at an airport. Passengers (requests) line up, and security checks them against a list of known threats. If a request matches a suspicious pattern, it gets flagged.

Here’s the typical process:

• Inspect Traffic: WAFs analyze HTTP requests as they enter.
  
  
• Apply Patterns: They compare traffic against known attack patterns.
  
  
• Decision Time: Based on the match, they either block or allow the request.
  
  

The result? Only clean traffic gets through. But the complexity of web standards means this process isn’t always foolproof.

Why WAFs Are So Complicated

A network firewall operates on TCP/IP traffic—a relatively simple, structured protocol. But a WAF deals with web traffic, which is anything but simple. Think HTML, CSS, JavaScript, file uploads, API calls, and more.

A network firewall makes binary decisions—allow or deny—based on IP addresses and ports. But a WAF analyzes the content, looking for signs of malicious intent. It’s a whole different ball game.

The Complexity of Web Traffic

The web is messy. Requests can come in all shapes and sizes:

• Static Content: Images, CSS, JavaScript files.
  
  
• Dynamic Requests: APIs, AJAX calls.
  
  
• File Uploads: PDFs, reports, and multimedia.
  
  

A WAF tries to make sense of all this noise and distinguish between good and bad traffic. It’s no wonder that configuring a WAF is a daunting task.

Positive Security vs. Negative Security Models

WAFs operate in two modes:

• Positive Security (Whitelist): Only allow predefined safe requests.
  
  
• Negative Security (Blacklist): Block known bad patterns.
  
  

Most organizations prefer the negative security model because it’s easier to manage. Blocking known threats is simpler than creating a detailed list of what’s safe.

But there’s a downside. False positives—legitimate requests blocked as threats—can frustrate users and lead to operational headaches.

The False Alarm Dilemma

Imagine a car alarm that goes off every time a leaf falls on the windshield. That’s what happens when a WAF generates too many false positives. Security teams drown in noise, making it hard to identify real threats.

To fix this, organizations:

• Run in Audit Mode First: Monitor traffic without blocking.
  
  
• Fine-Tune Rules: Adjust patterns to reduce false positives.
  
  
• Gradually Switch to Blocking Mode: Only after the system is stable.
  
  

Why WAF Management Is Hard

WAFs don’t run themselves. They need constant care and attention. Many organizations buy a WAF, plug it in, and expect magic. But without a dedicated team to manage it, WAFs often become silent spectators.

Logs pile up, alerts go unnoticed, and before long, the WAF is either ignored or disabled. To avoid this fate, organizations need:

• Dedicated Staff: Someone who knows how to fine-tune the WAF.
  
  
• Regular Audits: To identify and reduce false positives.
  
  
• Continuous Learning: Keeping up with evolving threats.
  
  

Why Blocking Mode Matters

A WAF sitting in monitoring mode is like a security camera without a guard. It records everything but does nothing to stop the bad guys. Only when a WAF operates in blocking mode does it become an effective line of defense.

Sure, it takes time and effort to fine-tune a WAF. But once it’s properly configured, it can block real threats while minimizing false positives.

Training and Expertise: The Key to Success

WAFs aren’t plug-and-play. They require expertise. Security teams need to invest in:

• Training: Learning how to configure and manage WAFs.
  
  
• Documentation: Understanding vendor-specific nuances.
  
  
• Ongoing Practice: Staying updated with emerging threats.
  
  

Without this, organizations risk having a WAF that’s either too aggressive (blocking legitimate traffic) or too lenient (letting threats slip through).

Conclusion: Guard Your Web Application the Right Way

A web application firewall is like a security checkpoint for your web app. It’s not perfect, but when configured correctly, it can stop many threats before they reach your servers. ModSecurity continues to dominate the open-source space, while commercial WAFs provide polished, enterprise-ready options.

But here’s the secret—no matter which WAF you choose, its effectiveness depends on how well it’s managed. Don’t let your WAF become another forgotten tool. Dedicate the time and resources needed to make it your most reliable ally in the fight against cyber threats.

Join CISO Platform — the CyberSecurity Community
Gain exclusive insights from top security professionals and access cutting-edge research.
Join Now

By: Christian Folini (Teacher and Security Engineer, Partner, Netnea.com)

When you get into a car, the seatbelt is your first line of defense. It's automatic—click it, and you’re safer. But it doesn’t mean you stop watching the road or ignore traffic rules. A seatbelt reduces the impact, but it’s not a magic shield. The same goes for ModSecurity and the OWASP Core Rule Set (CRS) in web security. They’re the seatbelt for your web applications—basic protection that’s easy to set up and gives a great return on investment.

Why Basic Security Matters

Think about driving. Even with airbags, anti-lock brakes, and lane assist, the seatbelt is your baseline safety. Similarly, a Web Application Firewall (WAF) acts as a seatbelt for your web application. It's not a one-size-fits-all solution, but it significantly reduces the damage from a potential attack.

When configured correctly, ModSecurity and the OWASP CRS block standard, well-known web threats. Attackers need to work much harder to develop exploits that bypass these defenses. And even if they do, there’s a good chance they won’t get the response they need to succeed.

Introducing ModSecurity: The Engine Behind Your Protection

ModSecurity, often called "ModSec," is an open-source web application firewall (WAF). It monitors incoming HTTP traffic and filters out malicious requests. But here’s the catch—ModSecurity itself doesn’t do much without rules.

Imagine a car engine. Without fuel and a properly tuned system, it’s just a block of metal. ModSecurity works the same way. It’s the engine, but the real power lies in the rules that guide it.

The Role of OWASP Core Rule Set (CRS)

Enter the OWASP Core Rule Set (CRS)—the fuel that powers ModSecurity. CRS is a set of carefully curated rules designed to identify and block common web application attacks. From SQL injection to cross-site scripting (XSS), CRS is the intelligence that makes ModSecurity effective.

ModSecurity alone can’t protect you. But when paired with CRS, it becomes a formidable line of defense against malicious traffic. It's like giving your car the best fuel and fine-tuning the engine for maximum performance.

What’s Under the Hood: How ModSecurity and CRS Work Together

Picture a highway. Cars are zipping by, and you need to identify which ones are safe and which ones might be dangerous. ModSecurity sits at the entrance, analyzing every car (HTTP request) that passes through. CRS is the guidebook, telling ModSecurity what to look for and what to block.

Here’s how it plays out:

• ModSecurity intercepts incoming requests.
  
  
• CRS evaluates the requests using predefined rules.
  
  
• If the request matches a known attack pattern, it’s blocked.
  
  
• Legitimate requests continue to their destination, ensuring business as usual.

Why It’s Not a Silver Bullet

Much like a seatbelt, ModSecurity and CRS are not perfect. They’re a solid starting point, but they won’t stop everything. False positives—when legitimate traffic gets flagged as malicious—can spoil the experience. However, with fine-tuning and ongoing maintenance, false positives become manageable.

Christian Folini, a co-lead of the OWASP CRS Project, explains it best: "A web application firewall, when done properly, is a good return on investment... but it's no silver bullet."

Security teams need to stay vigilant, just like drivers still need to stay alert even with seatbelts and airbags.

Handling False Positives: Fine-Tuning for Accuracy

False positives can make managing a WAF frustrating. Imagine your seatbelt tightening unnecessarily every few minutes while driving—annoying, right? ModSecurity and CRS can trigger similar "false alarms," blocking harmless traffic.

To address this:

• Audit Mode: Start with audit mode to identify false positives without blocking traffic.
  
  
• Custom Rules: Adjust CRS rules to better fit your application.
  
  
• Exception Handling: Allow safe traffic while maintaining high security.
  
  

Why ModSecurity and CRS Are a Worthy Investment

Security is about layers. A WAF isn’t the only layer, but it’s an essential one. ModSecurity and CRS give you:

• Baseline Protection: Immediate defense against common attacks.
  
  
• Time to Respond: Slows down attackers, giving you more time to detect and mitigate threats.
  
  
• Better ROI: Low-cost, high-impact protection for web applications.
  
  

Getting Started: Setup and Configuration

Ready to install ModSecurity and CRS? Here’s a simple guide:

1. Install ModSecurity: Available as a module for Apache, Nginx, and IIS.
   
   
2. Download and Integrate CRS: Fetch the latest version of the OWASP CRS.
   
   
3. Test in Audit Mode: Identify potential false positives.
   
   
4. Switch to Blocking Mode: Once configured, enable full protection.
   
   

What Happens If You Ignore It?

Driving without a seatbelt is risky. Similarly, running a web application without a WAF is asking for trouble. You leave the door open for:

• SQL Injections: Attackers manipulate your database.
  
  
• XSS Attacks: Injecting malicious scripts into your site.
  
  
• Brute Force Attacks: Repeated login attempts to gain unauthorized access.

Without ModSecurity and CRS, these threats could slip through unnoticed.

Christian Folini: The Man Behind the Protection

Christian Folini, a security engineer, speaker, and co-lead of the OWASP CRS Project, is a driving force behind improving ModSecurity’s capabilities. As the author of the ModSecurity Handbook (2nd edition), he’s dedicated to helping security professionals get the most out of their WAF setups.

Folini’s contributions to the community ensure that security teams have free access to top-tier protection. His passion for cybersecurity has led to a wealth of free resources, online classes, and in-depth training sessions.

Demo and Hands-On Insights: Putting Theory into Practice

Folini doesn’t just talk about ModSecurity—he demonstrates it. His extensive demos walk users through installation, configuration, and managing false positives. In his sessions, he uses security scanners to show real-world scenarios where ModSecurity and CRS make a tangible difference.

Conclusion: Seatbelt on, Safety Up!

Just like a seatbelt is a must-have for every car ride, ModSecurity and the OWASP Core Rule Set are non-negotiables for web applications. They’re your first line of defense, giving you a strong start while you layer on other security measures.

Don’t leave your web application unprotected. Buckle up with ModSecurity and CRS, and stay safe on the digital highway.

Join CISO Platform — the CyberSecurity Community
Gain exclusive insights from top security professionals and access cutting-edge research.
Join Now

By: Christian Folini (Teacher and Security Engineer, Partner, Netnea.com)

Introduction

Imagine your home guarded by a loyal family dog. It’s friendly, greets your guests, and barks only when a real threat emerges. But what happens when that same dog is suddenly tasked with guarding a high-security vault? It transforms into a fierce guard dog, ready to pounce at the slightest sign of intrusion. This is exactly how OWASP ModSecurity Core Rule Set (CRS) behaves—switching between a family-friendly pet and an untamed protector depending on its Paranoia Level (PL).

As cyber threats become more sophisticated, security professionals need a fine balance between protection and flexibility. CRS achieves that balance by allowing organizations to set different Paranoia Levels to detect and prevent web-based attacks. The deeper we dive into these levels, the more aggressive and precise the rules become.

Understanding Paranoia Levels: Dog Metaphor Edition 

Let’s break down Paranoia Levels with a fun analogy. Picture a dog that adjusts its behavior based on its environment:

• Paranoia Level 1: The family dog. Friendly, welcoming, and reacts only to obvious intruders. This level minimizes false positives and is suitable for most internet-facing applications. Basic protection with minimal fuss.
  
  
• Paranoia Level 2: A suspicious watchdog. It sniffs out trouble more often, but occasionally mistakes a friendly neighbor for an intruder. It’s perfect for online shops or applications dealing with real user data.
  
  
• Paranoia Level 3: The guard dog. Barking at every knock on the door. It monitors closely and is ideal for high-stakes environments like online banking, where every transaction is under the microscope.
  
  
• Paranoia Level 4: The mad dog. Ready to pounce at the slightest provocation. It's hyper-vigilant but needs constant training to distinguish between threats and friendly visitors. Reserved for applications where nothing less than nuclear-grade security will do—think military institutions or nuclear plants.
  
  

Why Paranoia Levels Matter

Security is never one-size-fits-all. An online shopping portal doesn’t need the same level of security as a classified government database. CRS allows you to adjust the rules depending on your application’s sensitivity.

Here’s the breakdown:

• PL 1: Baseline security for any internet-facing service. Minimal false positives. Ideal for public websites.
  
  
• PL 2: Enhanced security for services handling sensitive data. A few false positives are expected. E-commerce platforms fit this bill.
  
  
• PL 3: Stringent security with specialized rules. Requires experienced handlers to manage false positives. Online banking services or financial institutions fall here.
  
  
• PL 4: Maximum security for mission-critical applications. High false positives, but top-notch protection. Perfect for high-stakes infrastructures.
  
  

Training the Mad Dog: False Positives and Rule Tuning

Running Paranoia Level 4 without training is like leaving a guard dog untrained—it bites everyone, even the mailman. False positives are the bane of high paranoia levels. When the rules get stricter, they sometimes mistake legitimate requests for malicious activity.

False Positives Explained:

• A friendly guest mistaken for an intruder? False positive.
  
  
• An actual attacker identified as a threat? Success.
  
  

To prevent unnecessary “bites,” security teams invest time training CRS, writing rule exclusions, and continuously testing. This ongoing effort is crucial for environments operating at PL 3 or PL 4.

Why Training Matters:

• New software releases introduce new traffic patterns—just like a new mailman visiting the house.
  
  
• False positives lead to unnecessary blocking of legitimate traffic, affecting user experience.
  
  
• Writing exclusions and tuning rules smooths the guard dog’s responses, ensuring a balance between security and user access.
  
  

Diving Deeper: Rule Groups and Their Importance

CRS rules are grouped by topic and assigned unique IDs. Think of these as commands given to the guard dog to recognize various threats. These rule groups cover a wide range of attack vectors, from protocol enforcement to SQL injection prevention.

Key Rule Groups:

• 920 Protocol Enforcement: Ensures HTTP protocol compliance.
  
  
• 930 Local File Inclusion Protection: Prevents unauthorized file access.
  
  
• 932 Remote Command Execution Detection: Blocks shell command injections.
  
  
• 941 SQL Injection Detection: Protects against SQL-based attacks.
  
  
• 942 Cross-Site Scripting (XSS) Prevention: Identifies and stops malicious scripts.
  
  
• 949 Blocking Evaluation: Determines whether to block or allow the request.
  
  

The Art of Stricter Siblings: Evolving Paranoia with Rule Layers

CRS introduces a clever concept—stricter siblings. Each base rule has stricter versions at higher Paranoia Levels. Think of it as a family of rules where each sibling is more disciplined and less forgiving.

Example: Byte Range Enforcement

• PL 1 (Base Rule): Allows the full ASCII range except null characters.
  
  
• PL 2 (Stricter Sibling): Accepts only visible ASCII characters, plus tab and newline.
  
  
• PL 3: Narrows the range further by excluding special characters like the percent sign.
  
  
• PL 4: Allows only a minimal set of characters, treating everything else as suspicious.
  
  

This layered approach ensures that as the paranoia level increases, the rules become more rigorous—like a family dog transforming into a SWAT-trained protector.

Paranoia in Action: Making a Reasonable Decision

When deploying CRS, security teams need to assess the value of the data being protected. A business hosting sensitive customer data should aim for Paranoia Level 2 or 3. However, a financial institution processing millions of transactions may consider Paranoia Level 4 worth the investment—despite the effort required to tame the false positives.

Decision-Making in Action:

1. Evaluate the Application: How valuable is the data? What are the potential risks?
   
   
2. Discuss with Stakeholders: Involve developers, security teams, and business units.
   
   
3. Set the Right Level: Balance security with operational efficiency.
   
   
4. Allocate Time for Rule Tuning: Be ready to invest 4-6 days for false positive management.
   
   

Conclusion: Strike the Right Balance

OWASP ModSecurity Core Rule Set empowers organizations to choose their security posture wisely. Whether it’s a family dog watching the front yard or a military-trained guard dog protecting the crown jewels, CRS adapts to the situation. Paranoia Levels give security professionals the power to fine-tune protection without compromising performance.

For Chief Information Security Officers (CISOs) and cybersecurity teams, finding the right level is like striking a balance between vigilance and trust. With the right Paranoia Level and some dedicated training, CRS can be the perfect guard dog—friendly when needed, ferocious when required.

Join CISO Platform — the CyberSecurity Community
Gain exclusive insights from top security professionals and access cutting-edge research.
Join Now

By: Christian Folini (Teacher and Security Engineer, Partner, Netnea.com)

Unmasking Threats with Rule Validation and Scoring

Think about securing your home. You’ve installed surveillance cameras, sensors, and even a guard dog. But what happens when someone manages to sneak in? Wouldn’t it be great to have a system that not only detects the intruder but also evaluates the level of threat?

That’s where OWASP ModSecurity Core Rule Set (CRS) Part 6 steps in. It digs into the error logs, interprets patterns, and scores threats to decide whether to block or allow requests.

Error Logs: The Hidden Story

The real action happens behind the scenes—in the error log. Every suspicious request triggers a rule, and these rules write details to the error log. But reading through raw logs is like looking for a needle in a haystack.

Here’s where unique request IDs come into play:

• Unique Identifiers: Every request is assigned a unique ID that ties the access log and the error log together.
  
  
• Pattern Matching: Alerts appear in the error log, giving insights into what triggered the rule.
  
  
• Deep Analysis: You can search for this unique ID in the error log to uncover what ModSecurity flagged and why.
  
  

Think of the error log as a detective’s notebook. Every clue points to something bigger.

Rule Matching and Scoring

In this part of the CRS journey, we encounter the concept of scoring and rule matching. Imagine a system where each suspicious activity adds points to an overall score. When the score exceeds a defined threshold, action is taken.

1. Paranoia Levels and Strictness

CRS operates at different paranoia levels. The higher the level, the stricter the rule enforcement.

• Paranoia Level 1: Basic protection, fewer false positives.
  
  
• Paranoia Level 4: Ultra-strict, catching everything but often leading to higher false positives.
  
  

In this scenario, a request triggered rules at Paranoia Level 4, where strict character sets are enforced. Even a single invalid byte can trigger an alert.

Rule IDs and Their Messages

Each alert comes with a rule ID that points to the exact rule that was triggered. Here’s a quick breakdown:

• Rule 920273: Invalid characters in the request. This rule enforces strict ASCII character checks, flagging any deviation.
  
  
• OS File Access Attempt: CRS knows when a sensitive file path is requested (like /etc/passwd). This triggers a critical alert.
  
  
• Remote Command Execution (RCE): Certain patterns hint at potential RCE attempts, adding more points to the score.
  
  

These rules not only alert you but also score the request. A higher score increases the likelihood that the request is malicious.

The Scoring Game: Block or Pass?

ModSecurity works like a scoring system in a video game. Each violation adds points. If the score crosses a certain threshold, the request is blocked.

• Threshold Set to 5: Initially, the threshold was relaxed, allowing most requests to pass.
  
  
• Threshold Lowered Back to 5: After analysis, the threshold was returned to its original value. The system started blocking suspicious requests again.
  
  

When the threshold is low, even minor violations get blocked. But if the threshold is high, only severe attacks trigger a block.

Validating Rules in Action

Here’s where things get interesting. After detecting a suspicious request, the analyst dives into the error log.

• Error Log Analysis: Searching for the unique request ID reveals a list of triggered rules.
  
  
• Rule Patterns Identified: Complex patterns and parameter matches expose the potential attack.
  
  
• Scoring Validation: Each rule adds to the overall score, ultimately deciding whether to allow or block the request.
  
  

In one instance, a search query included a suspicious string:

bash

CopyEdit

cat /etc/passwd

This immediately triggered an OS File Access Attempt rule. But the magic happens when multiple rules combine and push the score past the threshold.

Real-World Threat Validation

Security teams often run security scanners like Burp Suite or Nikto to validate CRS configurations.

1. Nikto – The Fast but Weak Scanner

Nikto is fast, but not the smartest scanner. It runs through 3,296 requests in seconds, generating alerts for 7 rules per request.

• 41,000 Entries in the Log: Almost all requests triggered ModSecurity rules.
  
  
• Blocked with Access Denied (403): CRS aggressively blocked Nikto’s requests, marking them as suspicious.
  
  

2. ModSecurity Alias for Easier Analysis

To make log analysis easier, security experts often create shell aliases that group and format error logs. This allows them to:

 Quickly search and grep for relevant request IDs.
Extract and categorize rule messages.
  Count alerts and analyze blocking behavior.

Access Denied: The Final Block

When a request crosses the score threshold, Rule 949110 steps in.

• Access Denied with Code 403: This rule blocks the request, marking it as malicious.
  
  
• No More Warnings: Unlike previous warnings, this rule ensures that suspicious traffic is denied access.
  
  

Without this block, an attacker could bypass security controls and access sensitive data.

Lessons for Cybersecurity Leaders

For CISOs, CIOs, and Security Managers, understanding CRS Part 6 is essential for fine-tuning security rules.

• Log Analysis is Key: Reviewing error logs helps uncover rule patterns and improve configurations.
  
  
• Adjusting Paranoia Levels: Tuning paranoia levels can balance security and usability.
  
  
• Threshold Management: Setting the right threshold ensures that false positives don’t disrupt operations.
  
  

Testing and Fine-Tuning CRS

Testing CRS is not a one-time effort. Security teams should:

Regularly Run Security Scans: Use scanners like Nikto and Burp Suite to evaluate CRS effectiveness.
Analyze Logs for Insights: Search for unique IDs to correlate request logs and error logs.
Optimize Rule Sets: Adjust thresholds and fine-tune rules based on real-world traffic.

Final Thoughts

Mastering the OWASP ModSecurity Core Rule Set isn’t just about setting it up and forgetting it. It’s about constantly validating, adjusting, and fine-tuning the system.

CRS Part 6 empowers security teams to:

 Analyze error logs for patterns.
  Identify suspicious requests through scoring.
  Block malicious traffic before it causes damage.

Stay vigilant. Fine-tune your CRS. Block the threats before they breach your digital walls.

Join CISO Platform — the CyberSecurity Community
Gain exclusive insights from top security professionals and access cutting-edge research.
Join Now

By: Christian Folini (Teacher and Security Engineer, Partner, Netnea.com)

The Final Layer of Defense for Web Applications

Imagine having a guard dog that not only watches your house but knows who to bark at and who to ignore. ModSecurity does just that for web applications. But like a smart dog that gets better with training, it evolves with OWASP’s Core Rule Set (CRS). In Part 5, we take a closer look at how to fine-tune this setup for maximum security.

Setting Up CRS to Protect Your Application

Step 1: Basic Configuration
You start by configuring ModSecurity in Apache. You need to define file names, log names, and housekeeping rules. XML and JSON requests are handled differently, so body processors must be set up properly. This groundwork ensures that ModSecurity can handle different types of data formats smoothly.

Step 2: Downloading and Cloning CRS
To put CRS in action, the rule set is cloned and downloaded. Using wget or git clone ensures you have the latest version. But beware! You don't want to accidentally overwrite an existing configuration when upgrading. Always copy the crs-setup.conf.example file and turn it into crs-setup.conf.

Step 3: Loading Core Rules
Once the config file is set, it's time to load the core rules. These rules live in the rules folder and are activated when the server starts. From protocol enforcement to SQL injection protection, every rule adds a score when it detects something suspicious.

Testing Vulnerable Applications: A Reality Check

Picture this: A vulnerable CGI application sitting out in the open. It accepts SQL commands in the search field. You enter SELECT * FROM users and — boom! — it shows everything. You try /etc/passwd, and it leaks sensitive files. The application is practically begging for a breach.

But here’s where CRS saves the day. By placing ModSecurity with CRS in front of the application, these dangerous queries and commands get blocked before they can do any harm.

Activating and Enabling Key Modules

To get ModSecurity to work effectively, some modules need to be enabled:

• Mod CGI: Handles legacy applications.
  
  
• Security2 Module: Links ModSecurity with Apache.
  
  
• Proxy Modules: For advanced request handling.
  
  

These modules need to be enabled and configured correctly. Otherwise, CRS can’t do its magic.

Tuning Paranoia Levels: How Far Should You Go?

CRS works with a paranoia level that dictates how strict the rules should be. By default, paranoia level 1 is active. But as threats become more advanced, levels 2, 3, and 4 add deeper inspection.

• Level 1: Basic protection for common threats.
  
  
• Level 2: Adds more checks with minimal false positives.
  
  
• Level 3: Aggressive detection, higher risk of false positives.
  
  
• Level 4: Maximum paranoia — locks down almost everything.
  
  

To change paranoia levels, modify crs-setup.conf and uncomment the level you want. Raising the level increases the sensitivity and catches more threats. But be prepared for more alerts.

Fine-Tuning Thresholds: Avoiding Overblocking

Every rule assigns a score. If the combined score exceeds the threshold, the request is blocked. By default, this threshold is low, meaning even benign requests might get flagged.

To prevent this, the threshold can be raised — sometimes as high as 10,000. Raising the limit ensures that legitimate traffic isn’t unnecessarily blocked while keeping malicious requests at bay.

Checking Logs: Finding Out What Happened

Logs don’t just tell a story. They scream it. ModSecurity’s logs provide insights into what was blocked and why.

• Access Logs: Show what’s happening at the application level.
  
  
• Error Logs: Reveal what’s triggering ModSecurity to act.
  
  
• Audit Logs: Provide a deep dive into request and response data.
  

By analyzing these logs, security teams can refine CRS rules and improve response times to suspicious activity.

Real-Time Demo: Blocked or Not?

In a controlled test, CRS blocked all the dangerous queries sent to the vulnerable application. From accessing the /etc/passwd file to executing malicious SQL commands, every attempt was thwarted.

Even a more advanced SQL injection attempt, using UNION SELECT to exfiltrate data, was blocked when the paranoia level was set higher. The logs reflected the scored points and showed how quickly CRS adapted.

Why CRS Works So Well

The beauty of CRS lies in its flexibility. Whether you’re protecting a simple blog or a complex enterprise application, CRS adjusts to fit.

1. Quick Setup: Basic rules can be up and running in minutes.
   
   
2. Customizable Rules: Fine-tuning rules keeps false positives low.
   
   
3. Paranoia Levels: Balance between strictness and usability.
   
   

Advanced Protection with ModSecurity

CRS isn’t just about blocking threats. It adds a layer of learning. Each request and response provides feedback that makes future detections even sharper.

• Dynamic Scoring: Tracks suspicious patterns and increases awareness.
  
  
• Automated Blocking: Prevents common and complex attacks.
  
  
• Adaptability: Evolves with changing attack patterns.
  
  

Conclusion: Locking Down with CRS

In the world of web security, CRS serves as the last line of defense. By setting appropriate paranoia levels and fine-tuning thresholds, ModSecurity can protect even the most vulnerable applications. When configured right, CRS not only blocks threats but ensures that legitimate traffic flows smoothly.

So, the next time someone tries an SQL injection or probes for weaknesses, CRS will be there. Silent. Effective. Always on guard.

Join CISO Platform — the CyberSecurity Community
Gain exclusive insights from top security professionals and access cutting-edge research.
Join Now

By: Christian Folini (Teacher and Security Engineer, Partner, Netnea.com)

Protecting Your Applications with Confidence

Imagine running a high-speed train. Every minute, thousands of passengers board, and you need to ensure they get to their destination safely. But what if 1% of those passengers posed a potential risk? Wouldn’t it make sense to inspect that small percentage carefully while letting the others move freely?

This is exactly what happens when you implement Sampling Mode with the OWASP ModSecurity Core Rule Set (CRS). It’s a simple but powerful feature that ensures security without overwhelming your servers.

Understanding Sampling Mode

When deploying a web application firewall (WAF) like ModSecurity, performance is a critical concern. The CRS has a sampling mode that allows security teams to test the rule set on a small fraction of incoming requests. This way, 99% of the traffic flows normally while 1% is evaluated against CRS rules.

Here’s how it works:

• Low Impact on Performance: Only 1% of traffic triggers CRS rules, reducing CPU load and ensuring that performance remains intact.
  
  
• Safe Testing Ground: Sampling lets you test CRS without affecting the entire application. Any anomalies are limited to a small subset of requests.
  
  
• Minimized Disruption: If a legitimate user encounters an error, refreshing the page often resolves the issue, as the next request likely bypasses the CRS.
  
  

Think of it as dipping your toes in the water before diving in. You get a feel for what’s coming without taking unnecessary risks.

Commercial Players Using CRS

CRS isn’t just a theoretical concept. It’s actively used by major commercial providers who have adapted it to their ecosystems.

1. Fastly – Pioneering CRS in Varnish

Fastly, a content delivery network (CDN), doesn’t use ModSecurity directly. Instead, they transpose CRS into Varnish Configuration Language (VCL). Varnish is a high-performance caching server, and Fastly specializes in making it even faster by integrating CRS rules.

• No ModSecurity required.
  
  
• Pure Varnish-based CRS for ultra-fast performance.
  
  
• Proven to work effectively for Fastly’s high-traffic environment.
  
  

2. AWS – Managed CRS for the Masses

Amazon Web Services (AWS) offers CRS in its WAF Managed Rules available in the AWS Marketplace. Users can purchase and deploy CRS to protect their applications hosted on AWS infrastructure.

• Easy integration with AWS WAF.
  
  
• Paid service, but highly optimized for AWS environments.
  
  

3. Microsoft Azure – Custom CRS Implementation

Azure has taken CRS a step further by forking and re-implementing ModSecurity to better fit its cloud infrastructure. ModSecurity can be resource-intensive, and Azure optimized it for improved memory and CPU usage.

• Forked ModSecurity for enhanced performance.
  
  
• Seamless CRS integration into Azure WAF.
  
  

4. Oracle Cloud – Security with CRS

Oracle Cloud uses CRS, but the underlying architecture is less transparent. While it is known that Oracle Cloud leverages CRS rules, it’s unclear whether they use ModSecurity or a custom implementation.

• CRS support available for Oracle Cloud users.
  
  
• High security with minimal impact on performance.
  
  

5. Cloudflare – Pushing CRS Beyond Limits

Cloudflare initially started with CRS but has since built a more advanced system. Although you can still get CRS from Cloudflare, they now rely on their proprietary engine for enhanced protection.

• CRS used as a foundation for Cloudflare’s custom rules.
  
  
• Optimized for massive-scale internet security.
  
  

6. Verizon Media – Introducing Raffles

Verizon Media runs CRS but replaces ModSecurity with their own engine called Raffles. Although Raffles is technically open-source, it remains tightly linked to Verizon’s ecosystem, and few outside Verizon Media are using it.

• CRS deployed through Raffles for superior performance.
  
  
• Open-source but specialized for Verizon’s setup.
  
  

Why Sampling Mode Makes Sense

When testing CRS on a high-traffic application, sampling mode can save your day. Imagine running CRS at full capacity on an application that receives millions of requests per day. Without sampling, the server could face performance issues, slowing down operations or even crashing.

But by using sampling mode:

 No Performance Bottlenecks: Only a fraction of requests are processed by CRS, keeping things running smoothly.
  Real-Time Error Identification: Any issues that arise are isolated, making it easier to troubleshoot without affecting the entire system.
  Smooth Transition to Full CRS Deployment: Once you’re confident in the results, expanding to 100% traffic becomes a seamless process.

CRS in Action: Real-World Scenarios

Let’s say a company deploys CRS with sampling mode set at 1%. Most traffic passes without evaluation, but that 1% provides enough data to identify vulnerabilities and refine the rule set.

If a legitimate user encounters an error, a quick F5 refresh (reload) bypasses the CRS on the next attempt, ensuring minimal disruption. This flexibility makes sampling mode a go-to solution for companies introducing CRS to their production environment.

Key Takeaways for Cybersecurity Professionals

For CISOs, CIOs, Security Analysts, and Vulnerability Managers, understanding the practical implications of CRS and its commercial adaptations is crucial.

• Use Sampling Mode for Safe CRS Testing: Minimize risk by evaluating CRS on a small percentage of traffic.
  
  
• Explore Commercial CRS Offerings: Consider providers like AWS, Azure, and Fastly for optimized and pre-configured solutions.
  
  
• Stay Updated on CRS Enhancements: Providers like Cloudflare and Verizon Media continuously innovate on top of CRS, offering cutting-edge security solutions.
  
  

Final Thoughts

Deploying the OWASP ModSecurity Core Rule Set with sampling mode is like adding a safety net beneath a tightrope. You minimize risk, test with confidence, and ensure your application is ready for full-scale protection.

In a world where cyber threats lurk behind every digital corner, CRS offers a reliable defense. Whether it’s AWS, Azure, Fastly, or Cloudflare, these industry giants trust CRS—so should you.

Join CISO Platform — the CyberSecurity Community
Gain exclusive insights from top security professionals and access cutting-edge research.
Join Now

By: Christian Folini (Teacher and Security Engineer, Partner, Netnea.com)

Our editorial team has curated the finest sessions from the CISO Platform Top 100 Awards & Annual Conference 2025—India’s first award ceremony that celebrates those making a meaningful impact in the world of security. 

The 16th annual conference was held at Clarks Exotica, Bengaluru, bringing together over 200 attendees for insightful keynotes, engaging panel discussions, and interactive round tables, alongside valuable networking opportunities. The CISO Platform Top 100 Awards is more than just a recognition—it reflects a commitment to advancing the cybersecurity industry and strengthening the broader ecosystem. Over the years, the community has developed and shared 500+ best practices and frameworks as part of this initiative, driving meaningful change in the industry.

Here's the master guide:

Panel Discussions:

1. Implementing DPDPA For CISOs - Click Here

2. Evaluating AI Solutions: Understanding The "Real" vs "Hype"? - Click Here

3. 2025 Top Security Goals For A CISO - Click Here

4. AI For Bad vs Good: AI Use Cases For Offense and Defense - Click Here

5. Top Trends In Cybersecurity In 2025 - Click Here

Keynotes:

(P.S. The following blogs and session videos are currently in preparation. We’ll share the links as soon as they’re ready.)

1. Future Of SIEM: AI Automation & Autonomous Cybersecurity - Click Here

2. Orientation: The CISO Platform Community - Click Here

3. Building A Resilient Digital India: Cybersecurity In The Age Of AI - Click Here

4. AI As A Deputy CISO - Click Here

5. Unveiling AI Powered Data Security Posture Management With DPDPA Compliance - Click Here

6. Software Supply Chain Security - Click Here

7. Demonstration Of AI & Automated Attack Trees For Offensive Security 

Round Tables:

(P.S. The following blogs and session videos are currently in preparation. We’ll share the links as soon as they’re ready.)

1. Cloud Data Security Taxonomy For DPDPA - Click Here

2. Simplifying Financial Regulatory Compliance Using Fortinet Security Fabric

3. Implementing SEBI's CART Guidelines: Strategies, Challenges, And Practical Compliance Solutions

4. Neutralize Attack Paths And Exposure: Adopting An Attacker's Perspective - Click Here

Imagine this. You’re standing in your kitchen, making toast. Suddenly, you hear a dripping sound. You glance at the sink and notice water pooling around the base. It’s not a flood—yet—but it could be. You investigate the source, tighten a loose pipe, and wipe up the water before it causes damage. Crisis averted.

That’s how modern cybersecurity should work. Small drips turn into big floods if no one’s paying attention. Attackers love these “drips” in your network. And with AI, they’ve learned how to find them faster, scale their attacks, and hit where it hurts the most. The key to defending your organization? Learn to think like an attacker and neutralize their paths before the damage is done.

Let’s explore how.

Attackers Are Smarter Now (Thanks to AI)

Attackers aren’t just relying on brute force anymore. They’ve got AI, automation, and endless time on their side. What does that mean for you?
It means you’re dealing with threats that are:

• Scalable: Attackers can launch millions of phishing emails, personalized to each target. It’s like having an army that never sleeps.

• Automated: Vulnerability scans happen in seconds. They’re mapping your attack surface while you’re still sipping your coffee.

• Targeted: AI helps them craft the perfect bait, making phishing attempts look almost indistinguishable from real emails.

• Exploit-Focused: They’re not just searching for any weakness—they’re hunting for high-impact vulnerabilities that open critical pathways.

When attackers are this fast and adaptable, you can’t afford to move slowly.

The Problem with Vulnerability Management Today

Let’s face it—vulnerability management feels like running on a treadmill. You patch one issue, and ten more pop up. Why? Because the traditional ways of prioritizing vulnerabilities aren’t keeping up.

Here’s what’s broken:

1. Impact Is Hard to Measure: CVSS scores alone don’t cut it. Not every “critical” vulnerability is actually critical to your unique environment.

2. Too Much Noise: You’re drowning in alerts, false positives, and low-priority vulnerabilities that clog up your to-do list.

3. Attack Surface Blind Spots: You can’t defend what you can’t see. Shadow IT, misconfigurations, and third-party risks expand your attack surface.

4. Vulnerability Fatigue: Ever feel numb to all the alerts? You’re not alone. Many teams are stretched thin and start to tune out the noise.

5. Communication Gaps: Explaining technical risks to business leaders is like speaking two different languages. Without a common risk-based approach, things get lost in translation.

How to Neutralize Attack Paths

If traditional vulnerability management isn’t enough, what is? The answer lies in adopting an attacker’s perspective. Attackers don’t think in silos. They think in paths—chains of vulnerabilities that, when combined, give them access to your most valuable assets.

To stay ahead, you need to break those paths. Here’s how:

1. Use Attack Path Mapping Tools

Automated tools like CART (Continuous Automated Red Teaming) help map out potential attack paths in your environment. They identify the “low-hanging fruit” that attackers would target first and highlight the paths leading to critical assets.

It’s like following a trail of breadcrumbs—only you’re destroying the trail before anyone can follow it.

2. Red Teaming: Think Like an Attacker

Red teaming isn’t just about simulating attacks; it’s about uncovering the paths that attackers are most likely to exploit. Regular red team exercises help you test your defenses against real-world tactics.

Pro tip: Make it collaborative. Involve blue teams in the process to create a stronger, more unified defense.

3. Trend Analysis and CTEM (Continuous Threat Exposure Management)

Attackers evolve. Your defenses should, too. Trend analysis helps you spot emerging threats and adjust your strategy accordingly.

CTEM, on the other hand, is about continuous improvement. It’s not a one-time assessment; it’s a living, breathing process that evolves with your organization.

4. Simulate Attacks to Test Your Defenses

Attack simulation tools allow you to safely test how your defenses hold up against different attack scenarios. It’s like a fire drill for your network.

When done right, simulations reveal hidden vulnerabilities, misconfigurations, and gaps in your incident response plan.

5. Shift to Risk-Based Vulnerability Management (CRQ)

Not all vulnerabilities are created equal. A risk-based approach helps you focus on what matters most by tying vulnerabilities to business impact.

Using Cyber Risk Quantification (CRQ), you can calculate the financial impact of potential attacks and prioritize your efforts accordingly. It’s about shifting from “What’s vulnerable?” to “What’s most at risk?”

The Future of Cyber Defense: Stay Ahead by Staying Adaptive

In today’s threat landscape, standing still means falling behind. Attackers are evolving, and so should you. By thinking like an attacker, mapping out attack paths, and focusing on what really matters, you can stay one step ahead.

It’s not about patching everything—it’s about patching the right things at the right time.

Call to Action: Join the Cybersecurity Community

Want to stay ahead of the curve? Join CISO Platform, the global cybersecurity community where top CISOs share insights, strategies, and best practices.

Sign up today: Join CISO Platform

Contributors:

- Bikash Barai (Co-Founder at CISO Platform & FireCompass)

- Balkishan Chauhan (Technical Director - Skybox Security)

- Aftab Syed (Country Manager, Skybox Security)

Every company wants to unlock the magic of cloud data, but it’s not a free ride. Especially with data privacy laws like the Digital Personal Data Protection Act (DPDPA) keeping you accountable. Getting data security right can feel like juggling water balloons in a windstorm—but that’s where a smart taxonomy steps in.

Think of taxonomy as your cybersecurity GPS. It’s a framework that tells you where your data is, how it moves, and what’s protecting it. Let’s explore how this works under the DPDPA lens.

The Building Blocks of Cloud Data Security Taxonomy

The trick to managing cloud data security is breaking it down into bite-sized tasks. Here’s how you can do it:

1. Data Discovery and Inventory

First rule of data security: Know what you’re dealing with. Like cleaning out a messy attic, you need to find all the sensitive stuff hiding in shadow IT corners. Data discovery tools can scan your cloud environment and map your data assets.

Tip: Start with unstructured data. It’s often the sneaky culprit when breaches happen.

2. Data Flow Mapping and ROPA

Data doesn’t sit still. It flows. Mapping its path helps you answer key questions: Where does it go? Who touches it? This step also satisfies DPDPA’s Record of Processing Activities (ROPA) requirement.

Imagine: It’s like tracking a package—except the package is your customer’s personal info.

3. Data Matrix and Classification

Once you know what data you have, sort it. Not all data is created equal. Some need kid-glove handling (think health records or financial data). Others? Not so much.

Pro Tip: Use automated classification tools to label sensitive data in real time.

4. Privacy Impact Assessment (PIA)

A Privacy Impact Assessment (PIA) shows how your data practices impact people’s privacy. It’s like a stress test for your data processes. The goal? Spot risks before regulators do.

Example: If you’re using AI models, ask: Does this data get anonymized? Is consent crystal clear?

5. Data Minimization

Less is more. Collect only what you need. Store it only as long as you need it. DPDPA loves data minimization—and so should you.

Reality Check: Why hang on to old customer data if it’s not bringing value? That’s just extra baggage.

6. Risk Treatment

You’ve found your risks. Now what? Decide how to manage them. Some you can mitigate with controls. Others might need a transfer (cyber insurance) or acceptance.

Key Insight: Not every risk needs fixing. Prioritize based on impact.

7. Localization and Cross-Border Transfers

With DPDPA, data localization is a hot topic. Know where your data resides and where it travels.

Solution: Use cloud storage regions that align with your compliance needs.

Essential Security Controls for Cloud Data

Once you’ve mapped your data landscape, it’s time to lay down security guardrails. These controls reduce your attack surface and keep sensitive data safe.

1. Fundamental Security Controls

Start with the basics:

• Access controls (limit who can see what)

• Encryption (protect data at rest and in transit)

• Multi-Factor Authentication (MFA)

Analogy: Think of these as the locks on your cloud house.

2. Policies and Procedures

Clear policies set the tone. They tell employees what’s allowed and what’s not. Procedures guide your response to incidents.

Bonus: Align your policies with DPDPA to cover compliance gaps.

3. Privacy and Consent Management

Under DPDPA, users must give informed, explicit consent. A consent management tool helps automate this.

Quick Win: Make your consent forms simple and transparent.

Refined Tech Architecture for Cloud Data Security

Once your controls are in place, you’ll need the right tech stack to back them up. Here’s what’s trending in cloud data security:

1. Data Discovery and Classification Tools

Automatically find and classify sensitive data. This reduces manual effort and speeds up compliance.

Example Tools: BigID, Varonis

2. Data Loss Prevention (DLP)

Prevent accidental data leaks. DLP monitors emails, downloads, and file sharing.

Scenario: A sales rep accidentally tries to send a customer list to their Gmail account. DLP can block that.

3. Data Security Posture Management (DSPM)

DSPM tools give you continuous visibility into your cloud data security posture. They help you detect misconfigurations and compliance drift.

Benefit: Fix vulnerabilities before attackers exploit them.

4. Digital Rights Management (DRM) and Information Rights Management (IRM)

Control who can access your sensitive files—and what they can do with them.

Example: Allow a contractor to view a document but block downloads or screenshots.

5. Cloud Access Security Broker (CASB)

CASBs combine classification, DSPM, and IRM. They act as gatekeepers between your users and cloud apps.

Analogy: Think of CASB as the bouncer that enforces your cloud security policies.

6. Cloud Security Posture Management (CSPM)

CSPM tools continuously scan your cloud environment for misconfigurations.

Use Case: Detect open S3 buckets, exposed APIs, and other common cloud missteps.

7. Identity and Access Management (IDAM)

Manage user identities and control access. IDAM is critical for Zero Trust architecture.

Tip: Implement role-based access control (RBAC) to minimize privilege abuse.

Final Thought: Simplify to Secure

Data security doesn’t have to be overwhelming. By breaking it down into clear steps and leveraging the right tools, you can secure your cloud environment and stay DPDPA-compliant.

Remember, the cloud isn’t the wild west—not if you build a smart security taxonomy.

Join the Cybersecurity Community

Want more insights like this? Join CISO Platform and connect with 50,000+ security professionals. Let’s build a safer, smarter digital future together.

Sign Up Here: https://www.cisoplatform.com/main/authorization/signUp

Contributors:

- Bikash Barai (Co-Founder at CISO Platform & FireCompass)

- Aravinth Kumar Ramachandran (Director of Engineering, Barracuda Networks)