A deeper look

If you want to really understand more about how Shielding works, we have all the materials you’ll need to get started.

Move towards 100% security

We don’t just protect your business apps – we remove the possibility of attack altogether…

Challenges

Applications are constantly changing and so too are the vulnerabilities and exploits they carry with them. Project-based defence is no longer a viable approach, as the inherent delays leave vectors open for unacceptable timeframes.

How do you get effective, real time threat protection?

As the corporate world embraces digital and moves to the cloud, compliance becomes evermore important. Managing that transition can be treacherous.

Outcomes

We provide a strategic engagement that uncovers risks and remediates against any immediate concerns and develops a roadmap towards watertight security.

You need a continually tuned defensive configuration providing immediate response, and on-going assurance for your business transactions.

Our dedicated team of experts run a mature program to provide protection, and help you meet deadlines and compliance challenges with ease, and keep you secure during times of digital transformation.

A WAF is not enough

WAFs are ineffective security tools that disrupt legitimate transactions and absorb limited resources to maintain. Their chief problems are:

  1. They don’t secure any insecure application transactions causing you to fail audits and miss launch dates – your dev teams still have to fix these
  2. The controls a WAF uses, limiting what a user is allowed to do, are always able to be bypassed, and these controls unavoidably lead to ‘false positives’

These limitations led to the genesis of NG-WAFs where the focus is now just to detect and block bots, and real time threat protection is no longer the goal.

This is not effective. This is not enough.

Shields – remediation without touching code?

Shields are small blocks of compiled code designed to fix an otherwise exploitable vulnerability in an application.

By ostensibly eliminating susceptibility, and thus reducing the threat surface that an attacker can exploit, the issue is resolved to the same standard supplied by an expert (and security-aware development team) without anyone even needing to touch the original code!

So instead of buying a replacement, turning off the application, or blocking functionality; 
Shield it and totally remove any opportunity for hackers, while functionality remains unaffected.

Talk to us

The AppSec Journey

In an uninterrupted state, without any dangers, application data flows like it should. When threats are inevitably introduced, however, we need to protect against them, and ultimately secure against them by removing the possibility of attack altogether.

Default request-response

The default message pattern where a client sends a request message to a server that receives and processes the request, returning an appropriate response.

With malicious traffic

It’s fairly trivial for a threat actor to inject malicious scripts and have a browser run them. Typical attacks read cookies or redirect a user to a malicious site.

With a WAF activated

False positives, and false negatives abound.  Legitimate transactions are blocked, compromising functionality and providing minor security improvements.

Secured by Shielding

Each transaction is either stopped cold, disarmed, or has additional hardening measures are applied, without any impact to application response times.

Default request-response

A client (browser) submits a request to the app server; the server responds.
The response contains status about the request and potentially the requested content.

With malicious traffic

Malicious users are able to inject their attacks, and tamper with response packets.

With a WAF activated

While a WAF is going to try and block malicious transactions, unfortunately, sometimes false positives lead to genuine transactions also being dropped, impacting your customers. A WAF is also unable to protect against flaws in business logic.

Secured by Shielding

Regardless of content, every request is sanitised, neutralising any threat. Every response is made tamper-proof, forbidding the application to reach an unwanted state caused by an otherwise legitimate looking REQ.

The RedShield solution

The RedShield solution isn’t just the implementation of a Shield. It’s about the service that underpins the technology, and the agreement to share risk and take ownership of your security challenges.

 

A deeper dive

If you wish to learn more about Shielding and the shift left it can bring to your organisation, we have deeper technical resources available.

And if you have any questions, or wish to start the discovery process, you can reach out to us and organise a personalised demonstration.

Test drive RedShield

During a test drive, you can see the value of RedShield on one of your websites.
We'll help you make your vulnerabilities vanish, removing the ability to exploit completely.

Discovery call

If you’d prefer one of our consultants to reach out to you as a first step, please leave your contact details.

Test drive RedShield

If you wish to take RedShield for a test drive automatically, you can get started in just a few minutes.