[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-573799-105":53,"doc-detail-573799-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","f5-labs-2018-application-protection-report-executive-summary","F5 Labs 2018 Application Protection Report - Executive Summary","","F5 Labs’ 2018 Application Protection Report examines how web applications are attacked across interacting tiers, including application services, access, TLS, DNS, and the network. It synthesizes global intrusion and honeypot data, vulnerability insights from WhiteHat, and findings from security surveys and breach-notification record reviews. The report quantifies impacts of application attacks, identifies common attack patterns such as injection and account access hijacking, and outlines practical steps to manage security and reduce attack surface.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":51,"@type":70,"position":76},"https://docshare.wps.com/template/general/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/f5-labs-2018-application-protection-report-executive-summary/573799/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/f5-labs-2018-application-protection-report-executive-summary/573799.png","ImageObject",442,249,{"name":88,"@type":89},"Margaret","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-16","2026-10-14",true,{"@type":98,"interactionType":99,"userInteractionCount":76},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"What tiers does the report analyze for application attacks?","Question",{"text":108,"@type":109},"It examines application services, application access, TLS, DNS, and the network, treating each tier as a potential attack point.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"How did F5 Labs build an objective view of how applications are attacked?",{"text":113,"@type":109},"It combined internal datasets, WhiteHat vulnerability data, Loryka attack data, and a Ponemon survey of IT professionals commissioned by F5.",{"name":115,"@type":106,"acceptedAnswer":116},"What practical actions does the report recommend to protect applications?",{"text":117,"@type":109},"It provides a four-step approach, focusing on managing application security, handling vulnerabilities, applying controls, reducing attack surface, and integrating security into development.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},573799,1792086197,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":50,"category_name":51,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":76,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":135,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":141},137451207643,"https://ap-avatar.wpscdn.com/davatar_3d24733baf745e90a7e4bdd5f77d97b2","LABSF5  \n)))  \naPP  \nF5 LABS2018APPLICATIONPROTECTIONREPORT  \nloryka  \nPonemon  \nINSTITUTE  \nWhatcom  \nWhiteHat  \nSECURITY.  \nUNIVERSITYof  \nWASHINGTON  \nTACOMA  \nAUTHOR  \nRay Pompon is a Principal Threat Research Evangelist with F5 Labs.With over 20 years ofexperience in Internet security,he has worked closely with federal law enforcement in cyber-crime investigations.He was directly involved in several major intrusion cases,including the FBlundercover Flyhook operation and the NW Hospital botnet prosecution.He is the author of ITSecurity Risk Control Management:An Audit Preparation Plan published by Apress books.  \nCONTRIBUTORS  \nDebbie Walkowski  \nThreat Research Evangelist,F5  \nDavid Holmes  \nPrincipal Threat Research Evangelist,F5  \nSara Boddy  \nDirector,F5 Labs  \nJustin Shattuck  \nPrincipal Threat Research Evangelist,F5  \nBUSINESS AND DATA PARTNERS  \nLORYKA is a team of dedicated researchers monitoring and investigating emerging attacks,advanced persistent threats,and the organizations and individuals responsible for them.The teamalso develops research tools to identify,investigate,and track ongoing attacks and emergingthreats.Working with Loryka,we analyzed global intrusion and honeypot data collected from webattacks on 21,010 unique networks over 2017.  \nPONEMON INSTITUTE conducts independent research on privacy,data protection,and informationsecurity policy.For this report,we drew on results derived from two separate surveys of securityprofessionals,conducted on behalf of F5.  \nWHATCOM COMMUNITY COLLEGE CYBERSECURITY CENTER Special thanks to Seaver Milnorand Christy Saunders,both members of the computer information systems faculty at WCC,whoperformed an extensive review,analysis,and categorization of breach notification records filed withthe attorney generals'offices in California,Washington,Idaho,and Oregon.  \nWHITEHAT SECURITY is dedicated to helping enterprises ensure safe digital experiences bysecuring their applications.For this report,we cross-referenced much of the data collected fromsources mentioned above with WhiteHat vulnerability data.  \nUNIVERSITY OF WASHINGTON TACOMA graduate students assisted with background researchand data source analysis as part of their Masters of Cybersecurity and Leadership Capstoneresearch project.  \nF5 LABS  \n2018  \nAPPLICATIONPROTECTIONREPORT  \n# TABLE OF CONTENTS\n\nEXECUTIVE SUMMARY  \n7What apps do we use and where are they?8How could application attacks affect my organization?8AmI doing enough to protect my apps?How do lcompare with my peers?11Four steps to take to protect applications11What does the future of application protection look like?1315Applications are the reason we use the Internet1618Application services tier19Access control tier20Transport Layer Security tier20Domain Name System services tier21Network tier21App clients21Threats at each tier22How are apps attacked?22Web application attacks24Application infrastructure attacks24Denial-of-service attacks25Client attacks25  \nINTRODUCTION  \nWHAT ISANAPP?  \nWHAT HAPPENS TO AN ORGANIZATION WHENAPPS ARE ATTACKED?  \n27  \nAnalyzing applications forrisk  \n29  \nHow much does an attack hurt?What are the impacts?  \n32  \nWEB APPLICATION ATTACKS  \n37  \n37  \nTop breaches involving application servicesApplication attacks  \n38  \nExploits involving web application servicesTop attacks involving application servicesInjection attacksAccount access hijackingDeserialization attacksAdvanced persistent threats to applications  \n39  \n40  \n41  \n44  \n47  \n50  \nAPP INFRASTRUCTURE ATTACKS  \n53  \n54  \nAttacks against transport layer protection  \nCompromised certificates  \n57  \nDomain name services hijacking  \n60  \nDENIAL-OF-SERVICE ATTACKS  \n63  \nCLIENT ATTACKS  \n73  \n74  \nScripting attacks to hijack accessCross-Site request forgery attacksMalware attacks against app clients  \n75  \n76  \n4  \n# TABLE OF CONTENTS\n\nPROTECTING APPLICATIONS  \n79How is application security managed?80How are application vulnerabilities handled?80What security controls ar","cbCaiute7TJwTjPD","https://ap.wps.com/l/cbCaiute7TJwTjPD","pdf",14212369,106,"English","# Executive Summary\n## What apps do we use and where are they?\n## How could application attacks affect my organization?\n## Am I doing enough to protect my apps?\n## Four steps to take to protect applications\n## What does the future of application protection look like?\n# Introduction\n## What is an app?\n## What happens to an organization when apps are attacked?\n# Web Application Attacks\n## Top breaches involving application services\n## Injection attacks and access hijacking\n# App Infrastructure Attacks\n## Attacks against transport layer protection\n## Compromised certificates and DNS hijacking\n# Denial-of-Service Attacks\n# Client Attacks\n## CSRF, scripting attacks, and malware attacks\n# Protecting Applications\n## How is application security managed?\n## Reduce your attack surface\n## Prioritize defenses based on risk\n## Integrate security into development\n# The Future of App Protection","[{\"question\":\"What tiers does the report analyze for application attacks?\",\"answer\":\"It examines application services, application access, TLS, DNS, and the network, treating each tier as a potential attack point.\"},{\"question\":\"How did F5 Labs build an objective view of how applications are attacked?\",\"answer\":\"It combined internal datasets, WhiteHat vulnerability data, Loryka attack data, and a Ponemon survey of IT professionals commissioned by F5.\"},{\"question\":\"What practical actions does the report recommend to protect applications?\",\"answer\":\"It provides a four-step approach, focusing on managing application security, handling vulnerabilities, applying controls, reducing attack surface, and integrating security into development.\"}]","F5 Labs 2018 Application Protection Report - Executive Summary | PDF",1791946394,37]