Inclusion of websites and web applications in this list is not a surprise. Websites and web applications have always been targeted as an easy target and low hanging fruit by the hackers. The Indian government reported more than 26K plus website breaches in 2020 and 2021 simultaneously. These numbers are just the tip of ice burg, as it includes the known reported breaches. These numbers doesn’t account for any non-reported / non-detected incidents which according to us will be significantly high. 

Most of the organizations fail to detect a breach. The mean time to detect (MTTD) any breach by an organization in Asia is still more than 20 plus days. If you remove Ransomware (since ransomware breaches are easily visible and detected with hours) from these breaches, the time to detect breaches drastically increases to 36 days in Asia. 

The internet users count in India has increased to 640M subscribers by the end of Dec-2021. Covid 19 played an important role in this increase in Internet subscribers, as remote working (Working from Home WFH) and online education was introduced across the country in our day to day lifestyle. Organizations had to adapt to the newer ways by shifting their traditional operations to online within weeks, to keep them functional. Organizations ended opening various critical internal applications like CRM and HRMS over Internet for their users working from home. Cloud adaptability also drastically increased and assisted organizations to move faster in getting functional, as well as helping them move forward in their digital journey. The focus of the organization was to get the business operations functional quickly and security as always was an afterthought, which might have resulted in 26K plus breaches in last 2 years, enforcing the government to include website and web applications in the critical incidents list.

Many organization have on premise Web application firewall (WAF) which can’t protect applications moved to the cloud. Most of these WAF’s are hardware based or virtual instance. Customer hosting applications in multiple clouds (e.g. AWS, Azure, Google cloud) have to install one instance of Virtual WAF’s in each cloud. This increases the complexity of administration and management. While fine tuning of rules is a major issue in traditional legacy WAF’s, it also lacks advance features like Defacement, vulnerability management, web-shell detection, malware scanning for any uploads, scalability (scale as you grow) and performance. Custom rules attached to the legacy WAFs have often proven costly to write, manage and to maintain and contributes to the  impact of the performance of the WAF.