Think app security first

Apps are the gateway to your data—and your customer’s data. How do you protect your apps from today’s threats? By understanding them: knowing their components, supporting infrastructure, and what makes them vulnerable to attack. When you understand your apps, you’ll understand where to focus your resources to secure them.

Under Attack? Call (866) 329-4253 or +1 (206) 272-7969

Sécurité centrée sur les applications

Sachez ce qui rend vos applications vulnérables et comment elles peuvent être attaquées, afin de pouvoir mettre en place les bonnes solutions pour réduire vos risques.  Bénéficiez de la sécurité des applications dont vous avez besoin pour atténuer les menaces avancées d'aujourd'hui et continuer à faire progresser votre entreprise.

NEWS

F5’s acquisition of Shape Security enables scalable, end-to-end, multi-cloud application security

Attack Types

Explore the app components to understand each tier and the its associated threats.

APP

Explore the app components to understand each tier and the its associated threats.

SERVICES TIER

Web servers, content delivery networks, and app or database servers are the base for web application services. Also part of this tier are frameworks, libraries, and plugins, and internal code that provides an app's core functionality. Attackers frequently scan for unpatched components within this tier, making it the focus of common attacks, such as injection or business logic flaws.

POSSIBLE THREATS

ACCESS TIER

Access is the gateway to the data that an app processes or stores. This tier provides web, mobile, and API clients the ability to authenticate and get authorization to access an application, so it needs to be secure and efficient. An analysis of breach records shows that 33 percent of web app breaches are access related, with phishing, brute force, and credential stuffing attacks leading the way.

1 F5 Labs: Lessons Learned from a Decade of Data Breaches

POSSIBLE THREATS

TLS/SSL TIER

The transport layer security tier includes HTTPS, TLS, and even the outdated SSL protocol. It provides confidentiality for clients and apps communicating over untrusted networks, ensuring attackers can't tamper with data in transit. Flawed libraries or implementations can lead to vulnerabilities like Heartbleed or denial-of-service attacks. TLS is also used to hide payloads that target other tiers of the app.

POSSIBLE THREATS

DNS TIER

The "address book" of the Internet, DNS translates domain names into IP addresses so browsers can load Internet resources. This tier includes all DNS servers needed by the client and the app, as well as the relevant registrars of those apps' domains. App availability can be disrupted if its DNS suffers a DDoS attack. Alternatively, DNS can be targeted in a hijacking attempt that can compromise an app's confidentiality or integrity.

POSSIBLE THREATS

NETWORK TIER

Clients and apps need a network to connect. Many applications exist on or communicate over the biggest network—the Internet. An app also typically resides on an internal network, allowing app admins to connect and make changes. The network tier is a target of multiple types of DDoS attacks. Compromised internal networks can lead to unauthorized disclosure, alteration, or destruction of data.

POSSIBLE THREATS

DDOS ATTACKS

The purpose of a DDoS attack is to make an application unavailable. DDoS attacks typically originate from an "army" of hacker-controlled bots. All tiers of an app have a capacity limit or are designed in a way that's vulnerable to DDoS attacks. Volumetric attacks target the network tier, overwhelming bandwidth. Others target server or infrastructure resources such as CPU, memory, or state tables.

DDoS Solutions

Use Cases

WEB APPLICATION ATTACKS

Web app attacks target the data held by apps through layer 7 by attempting to steal a user's credentials via a man-in-the-middle attack or exploiting vulnerabilities in servers, frameworks, libraries or even business logic flaws within custom code. Also included are access-control attacks, like credential stuffing, brute force attacks, and credential theft via malware or phishing.

Web App Security Solutions

Use Cases

APP INFRASTRUCTURE ATTACKS

Application infrastructure refers to the systems that applications depend on that are external to the app itself. Attacks against application infrastructure target TLS, DNS, and the network tiers. These attacks can include compromising a vulnerable implementation of TLS/SSL, spoofing DNS to divert user traffic, a man-in-the-middle attack on a network, or a DDoS attack on any of these tiers.

App Infrastructure Solutions

Use Cases

ACCESS ATTACKS AND BUSINESS CHALLENGES

Attacks on access often consist of botnets attempting to brute force user accounts, test stolen passwords, or look for web apps with weak access controls. While preventing successful attacks is paramount, understanding how users access your apps can help you balance “least privilege” without compromising user productivity.

Access Solutions

Use Cases

ATTACK TYPES

HOW APPS ARE ATTACKED

What are apps and how are they attacked?

Applications are made up of many independent components, running in separate environments with different requirements and a supporting infrastructure that's glued together over networks. Each component, or tier, can be a target. To evaluate defenses, you need to understand the attack surface of each tier.

  • Services
  • Access
  • TLS
  • DNS
  • Network

What are apps and how are they attacked?

Applications are made up of many independent components, running in separate environments with different requirements and a supporting infrastructure that's glued together over networks. Each component, or tier, can be a target. To evaluate defenses, you need to understand the attack surface of each tier.

SERVICES TIER
services off

Web servers, content delivery networks, and app or database servers are the base for web application services. Also part of this tier are frameworks, libraries, and plugins, and internal code that provides an app's core functionality. Attackers frequently scan for unpatched components within this tier, making it the focus of common attacks, such as injection or business logic flaws.

POSSIBLE THREATS

ACCESS TIER
services off

Access is the gateway to the data that an app processes or stores. This tier provides web, mobile, and API clients the ability to authenticate and get authorization to access an application, so it needs to be secure and efficient.

An analysis of breach records shows that 33 percent of web app breaches are access related, with phishing, brute force, and credential stuffing attacks leading the way.

1 F5 Labs: Lessons Learned from a Decade of Data Breaches

POSSIBLE THREATS

TLS/SSL TIER
tlsOff

The transport layer security tier includes HTTPS, TLS, and even the outdated SSL protocol. It provides confidentiality for clients and apps communicating over untrusted networks, ensuring attackers can't tamper with data in transit.

Flawed libraries or implementations can lead to vulnerabilities like Heartbleed or denial-of-service attacks. TLS is also used to hide payloads that target other tiers of the app.

POSSIBLE THREATS

DNS TIER
dnsOff

The "address book" of the Internet, DNS translates domain names into IP addresses so browsers can load Internet resources. This tier includes all DNS servers needed by the client and the app, as well as the relevant registrars of those apps' domains.

App availability can be disrupted if its DNS suffers a DDoS attack. Alternatively, DNS can be targeted in a hijacking attempt that can compromise an app's confidentiality or integrity.

POSSIBLE THREATS

NETWORK TIER
networkOff

Clients and apps need a network to connect. Many applications exist on or communicate over the biggest network—the Internet. An app also typically resides on an internal network, allowing app admins to connect and make changes.

The network tier is a target of multiple types of DDoS attacks. Compromised internal networks can lead to unauthorized disclosure, alteration, or destruction of data.

POSSIBLE THREATS

ATTACK TYPES

HOW APPS ARE ATTACKED

Attack Types

Explore the app components to understand each tier and the its associated threats.

DDOS
services access dns network

The purpose of a DDoS attack is to make an application unavailable. DDoS attacks typically originate from an "army" of hacker-controlled bots.

All tiers of an app have a capacity limit or are designed in a way that's vulnerable to DDoS attacks. Volumetric attacks target the network tier, overwhelming bandwidth. Others target server or infrastructure resources such as CPU, memory, or state tables.

DDoS Solutions

Use Cases

WEB APPLICATION
services access

Web app attacks target the data held by apps through layer 7 by attempting to steal a user's credentials via a man-in-the-middle attack or exploiting vulnerabilities in servers, frameworks, libraries or even business logic flaws within custom code.

Also included are access-control attacks, like credential stuffing, brute force attacks, and credential theft via malware or phishing.

Web App Security Solutions

Use Cases

APP INFRASTRUCTURE
tls dns network

Application infrastructure refers to the systems that applications depend on that are external to the app itself. Attacks against application infrastructure target TLS, DNS, and the network tiers. These attacks can include compromising a vulnerable implementation of TLS/SSL, spoofing DNS to divert user traffic, a man-in-the-middle attack on a network, or a DDoS attack on any of these tiers.

App Infrastructure Solutions

Use Cases

ACCESS
tls dns network

Attacks on access often consist of botnets attempting to brute force user accounts, test stolen passwords, or look for web apps with weak access controls. While preventing successful attacks is paramount, understanding how users access your apps can help you balance “least privilege” without compromising user productivity.

APPRENDRE À SE DÉFENDRE CONTRE LES ROBOTS MALVEILLANTS SANS PERTURBER LES BONS.

Une organisation type possède 765 applications — et chacune d'entre elles est une cible potentielle. Vos applications sont-elles protégées ?

CONTENU ASSOCIÉ

La chasse à l'IoT

La croissance et l'évolution des Thingbots promet le chaos

Une décennie contre les atteintes à la protection des données

86 % des atteintes ciblent les applications et les identités.

Cloud

Rendre la sécurité du cloud conviviale

Une assistance qui assure la sécurité de votre entreprise

Nous sommes votre filet de sécurité

Lorsque des incidents de sécurité surviennent, notre équipe d'intervention en cas d'incident de sécurité (F5 SIRT) est là pour tous les clients F5.

Maximisez votre investissement

Les services aux professionnels de F5 peuvent vous aider à concevoir, personnaliser et mettre en œuvre une solution.

Nous vous protégeons 24 h/24 et 7 j/7

Les experts du SOC de F5 se tiennent entre vous et les menaces de sécurité qui peuvent nuire à votre entreprise.