While the hackers can have many motives to compromise your website, the top 3 motives can be categories into

• a) Gain access to your resources (bitcoin mining, host malware)
• b) Monetary gain (Data theft, Bot Network)
• c) Hacktivism & Boredom (Vandalism, fun)

Website traffic and performance always vary as it depends on the number of concurrent users accessing the website and browsing it. Monitoring teams do their best to ensure the website is up and running by adequate resourcing planning.

Hackers use systematic approach to compromise the website.

• a) Scan website
• b) Identify vulnerabilities in the website
• c) Inject code / exploit
• d) Take control
• e) Data exfiltration / host malware

Scanning websites for vulnerabilities are normally performed by hackers using sophisticated automated tools (such Nmap, Nikto, havij, sqlmap, burp suite etc). These are unauthorised scans and are the initial step of the attack. Hackers use the outcomes of the scans to further strategise their attacks. These scans can be long and can impact the performance of your website or even can cause an unplanned downtime.

We at SiteWALL not only detect complex web application attacks, but we also block these attacks in near real time without affecting the normal flow of the business data traffic.

Scans can be easily detected and blocked with Threat Intelligence integration. Threat Intelligence provides bad compromised IP’s and user agents used by attackers for scanning the website. Advance WAF like SiteWALL integrated with threat intelligence will block all scans and attacks from known IP’s and user agents.

Advance attackers often use dynamic IP’s and modify user agents to remain undetected and complete their scan to gain visibility of the vulnerability in the website. To resolve this issue permanently, we have developed an advance correlation technique by behavior analysis to block the attacker at the early stage of scan. We call it as “Dynamic Detection”. This is a fully automated technique and doesn’t need any prior learning of the website traffic. By enabling this technique, the attackers scans are mitigated with initial 10 mins with 100% accuracy and zero false positive.