Excerpt from the Report:
Account Takeovers: A New Defense Priority
It’s no longer good enough to place a traditional web application firewall in place and hope that it stops the attacks against your web applications. In order to protect against account takeover attacks, enterprises must instrument and analyze their users actions and patterns in detail. Knowing the baseline data for your application and your users’ usage patterns is a good place to start asking questions:
- What is the rate of normal authentication traffic?
- What happens in authentication failure modes and what is the average failure rate?
- What sensitive actions do users take when using the application?
- Does our application alert the engineering or security team when these actions and failures occur?
