Insights reveal record-breaking time-to-exploit
of new zero-day vulnerability, largest DDoS attack in the history
of the Internet, and increasing supply chain threats
Cloudflare, Inc. (NYSE: NET), the leading connectivity cloud
company, today published its State of Application Security 2024
Report. Findings from this year's report reveal that security teams
are struggling to keep pace with the risks posed by organizations’
dependency on modern applications—the technology that underpins all
of today’s most used sites. The report underscores that the volume
of threats stemming from issues in the software supply chain,
increasing number of distributed denial of service (DDoS) attacks
and malicious bots, often exceed the resources of dedicated
application security teams.
Today’s digital world runs on web applications and APIs. They
allow ecommerce sites to accept payments, healthcare systems to
securely share patient data, and power activities we do on our
phones. However, the more we rely on these applications, the more
the attack surface expands. This is further magnified by the demand
for developers to quickly deliver new features—e.g., capabilities
driven by generative AI. But if unprotected, exploited applications
can lead to the disruption of businesses, financial losses, and the
collapse of critical infrastructure.
“Web Applications are rarely built with security in mind. Yet,
we use them daily for all sorts of critical functions, making them
a rich target for hackers,” said Matthew Prince, co-founder and CEO
at Cloudflare. “Cloudflare's network blocks an average of 209
billion cyber threats for our customers every single day. The layer
of security around today’s applications has become one of the most
essential pieces to making sure the Internet stays secure.”
Key findings from Cloudflare’s State of Application Security
2024 Report include:
- DDoS attacks continue to increase in number and volume:
DDoS remains the most leveraged threat vector to target web
applications and APIs, comprising 37.1% of all application traffic
mitigated by Cloudflare. Top targeted industries were Gaming and
Gambling, IT and Internet, Cryptocurrency, Computer Software and
Marketing and Advertising.
- First to patch vs. first to exploit—the race between
defenders and attackers accelerates: Cloudflare observed faster
exploitations than ever of new zero-day vulnerabilities, with one
occurring just 22 minutes after its proof-of-concept (PoC) was
published.
- Bad bots—if left unchecked—can cause massive disruption:
One-third (31.2%) of all traffic stems from bots, the majority
(93%) of which are unverified and potentially malicious. Top
targeted industries were Manufacturing and Consumer Goods,
Cryptocurrency, Security and Investigations, and US Federal
Government.
- Organizations are using outdated approaches to secure
APIs: Traditional web application firewall (WAF) rules that use
a negative security model—the assumption that most web traffic is
benign—are most commonly leveraged to protect against API
traffic. Far fewer organizations use the more widely accepted API
security best practice of a positive security model—strict
definitions on traffic that is allowed, rejecting the rest.
- Third-party software dependencies pose growing risk:
Organizations use an average of 47.1 pieces of code from
third-party providers and make an average of 49.6 outbound
connections to third-party resources to help enhance website
efficiency and performance—e.g., leveraging Google Analytics or
Ads. But as web development has largely shifted to allow these
types of third-party code and activity to load in a user's browser,
organizations are increasingly exposed to supply chain risk and
liability and compliance concerns.
Report Methodology: This report is based on aggregated
traffic patterns (observed from April 1, 2023 - March 31, 2024)
across the Cloudflare global network. This data and threat
intelligence from Cloudflare’s network has been complemented by
third-party sources, as cited throughout the report. Cloudflare
mitigated 6.8% of all web application and API traffic during the
data collection period. Mitigated traffic is defined as any traffic
that is blocked or is served a challenge by Cloudflare. The
specific threat type and relevant mitigation technique depend on
many factors, such as the application’s potential security gaps,
the nature of the victim’s business and the attacker’s goals.
To learn more, please check out the resources below:
- Cloudflare State of Application Security 2024 Report
- Cloudflare Application Services
About Cloudflare
Cloudflare, Inc. (NYSE: NET) is the leading connectivity cloud
company on a mission to help build a better Internet. It empowers
organizations to make their employees, applications and networks
faster and more secure everywhere, while reducing complexity and
cost. Cloudflare’s connectivity cloud delivers the most
full-featured, unified platform of cloud-native products and
developer tools, so any organization can gain the control they need
to work, develop, and accelerate their business.
Powered by one of the world’s largest and most interconnected
networks, Cloudflare blocks billions of threats online for its
customers every day. It is trusted by millions of organizations –
from the largest brands to entrepreneurs and small businesses to
nonprofits, humanitarian groups, and governments across the
globe.
Learn more about Cloudflare’s connectivity cloud at
cloudflare.com/connectivity-cloud. Learn more about the latest
Internet trends and insights at https://radar.cloudflare.com.
Follow us: Blog | X | LinkedIn | Facebook | Instagram
Forward-Looking Statements
This press release contains forward-looking statements within
the meaning of Section 27A of the Securities Act of 1933, as
amended, and Section 21E of the Securities Exchange Act of 1934, as
amended, which statements involve substantial risks and
uncertainties. In some cases, you can identify forward-looking
statements because they contain words such as “may,” “will,”
“should,” “expect,” “explore,” “plan,” “anticipate,” “could,”
“intend,” “target,” “project,” “contemplate,” “believe,”
“estimate,” “predict,” “potential,” or “continue,” or the negative
of these words, or other similar terms or expressions that concern
Cloudflare’s expectations, strategy, plans, or intentions. However,
not all forward-looking statements contain these identifying words.
Forward-looking statements expressed or implied in this press
release include, but are not limited to, statements regarding
Cloudflare’s products and technology, Cloudflare’s technological
development, future operations, growth, initiatives, or strategies,
future market risks and trends, and comments made by Cloudflare’s
CEO. Actual results could differ materially from those stated or
implied in forward-looking statements due to a number of factors,
including but not limited to, risks detailed in Cloudflare’s
filings with the Securities and Exchange Commission (SEC),
including Cloudflare’s Quarterly Report on Form 10-Q filed on May
2, 2024, as well as other filings that Cloudflare may make from
time to time with the SEC.
The forward-looking statements made in this press release relate
only to events as of the date on which the statements are made.
Cloudflare undertakes no obligation to update any forward-looking
statements made in this press release to reflect events or
circumstances after the date of this press release or to reflect
new information or the occurrence of unanticipated events, except
as required by law. Cloudflare may not actually achieve the plans,
intentions, or expectations disclosed in Cloudflare’s
forward-looking statements, and you should not place undue reliance
on Cloudflare’s forward-looking statements.
© 2024 Cloudflare, Inc. All rights reserved. Cloudflare, the
Cloudflare logo, and other Cloudflare marks are trademarks and/or
registered trademarks of Cloudflare, Inc. in the U.S. and other
jurisdictions. All other marks and names referenced herein may be
trademarks of their respective owners.
View source
version on businesswire.com: https://www.businesswire.com/news/home/20240625803487/en/
Cloudflare, Inc. Daniella Vallurupalli Vice President, Head of
Global Communications press@cloudflare.com
Grafico Azioni Cloudflare (NYSE:NET)
Storico
Da Mag 2024 a Giu 2024
Grafico Azioni Cloudflare (NYSE:NET)
Storico
Da Giu 2023 a Giu 2024
