Top Risks
October 08, 2019

2019 Application Protection Report Podcast Series

By Raymond Pompon, Sander Vinberg


The F5 Application Protection Report podcast returns for 2019! Last year, F5 Labs researchers examined the entire landscape of threats facing applications, and offered guidance on how to protect them. This year, they followed up with another research series that examined how both apps and threats are changing, and what security practitioners can do to stay ahead of these changes. In this podcast, host and Director of F5 Labs, Sara Boddy, will be interviewing the two researchers behind the series, Ray Pompon and Sander Vinberg, to talk about their approach, methods and findings.

Episode One: Methods, Easy Targets, and Breach Data

Sara begins by unpacking what’s changed in this year’s research, covering changes in personnel, data sources, and research scope. The team then turns to the first significant finding of the new research series: the discovery of widespread, unsophisticated reconnaissance campaigns targeting PHP. While systems running PHP were a major target last year as well, the proportion of opportunistic traffic looking for old, unprotected PHP vulnerabilities was even higher this year. After that they dive into one of their major data sources, the breach notifications published by individual U.S. states. One of the findings from the breach disclosures was a strong relationship between victims’ industries and the attack methods. Ray, Sara, and Sander look at why that is, and what it means for defenders.

Episode Two: Injection, Evolved

The Labs team dives into the subject of injection—one of the most prevalent and successful attack techniques featured in the breach notifications. Injection techniques have been around for a long time, and constituted a major finding in the 2018 report, but they’re evolving to target different vulnerabilities because of the way that web applications are being built. As a result, a new injection technique known as formjacking has surpassed SQL injection as the most common manifestation. Ray and Sander discuss what this means for preventing, detecting, and defending against web application attacks in 2019 and onward, and make some predictions about the future of web app architecture.


Expertly picked stories on threat intelligence

Hundreds of apps will be attacked by the time you read this.

So, we get to work. We obsess over effective attack methods. We monitor the growth of IoT and its evolving threats. We dive deep into the latest crypto-mining campaigns. We analyze banking Trojan targets. We dissect exploits. We hunt for the latest malware. And then our team of experts share it all with you. For more than 20 years, F5 has been leading the app delivery space. With our experience, we are passionate about educating the security community-providing the intel you need to stay informed so your apps can stay safe.


9 hrs

a critical vulnerability—with the potential for remote code execution—is released.