Learn how to strengthen your infrastructure with Web Application Firewalls (WAF) and advanced security features. Perform SSL/TLS offloading and protect against application layer threats to ensure your critical systems are always compliant and protected.
Customers with manually configured, custom client authentication deployments (rare) or using “re-encrypt to backend” to communicate with untrusted third-party servers (very rare) may be impacted...
A local privilege escalation vulnerability was found on polkit's pkexec utility. It is a critical vulnerability because it gives full root privileges to any local user or attacker...
All WAF vendors and services using ModSecurity are affected by this vulnerability (unless they have the vulnerable piece of code disabled, by chance)...
Network Security devices such as firewalls, WAF, SWG, IPS etc. are often deployed inline with bridge mode., which has two major problems...
A WAF isn't a magic bullet, but, as part of a defense in depth strategy, a properly configured WAF should catch and stop common, everyday attacks...
The Apache Log4j utility is commonly used for logging requests by millions of Java applications to log error messages. However, recently the critical vulnerability CVE-2021-44228 was discovered in the Apache Log4j library...
On the 4th October 2021, the social media giant Facebook experienced a global outage, affecting not only Facebook, but also Instagram and WhatsApp...
In this example, I’m going to add a new transformation function to ModSecurity to calculate the Scrabble score of a variable. This will allow us to block HTTP requests containing query string parameters with a Scrabble score above a chosen threshold...
A customer asked me how to export a list of SSL/TLS certificate expiry dates from our load balancer appliance...
Splunk Enterprise enables you to search, analyze, and visualize the data gathered from the components of your IT infrastructure or business...
Working with our pre-sales customers, there is a misconception that you always need source IP transparency - which is not always the case...
In early June 2021, I identified a request body bypass vulnerability in the OWASP ModSecurity Core Rule Set (CRS). Loadbalancer.org appliances themselves are unaffected...
