Websites that can self-defend against attackers: Video

Websites that can self-defend against attackers: Video

Summary: If a website falls under attack by a hacker, why shouldn't it be able to respond? Juniper Networks shows ZDNet how businesses can fight back against common website attacks and help others know what is coming.

TOPICS: Security

Australian banks like the National Australia Bank have said that organisations should look at the early warning signs of an attack and take action, but no one does.

However, according to Juniper Networks' Director of product management Swastik Bihani, not only is it possible to detect and take action when an attacker targets a website, today's technology allows companies to slow their attacker down, profile them, and even share information to prevent completely separate businesses from being attacked by the same person.

In a technical demonstration session with ZDNet, Bihani shows how traditional web application firewalls fail to prevent simple but common SQL injection attacks, and how businesses can instead mislead would-be attackers in order to give up more information about themselves.

After identifying an attack, businesses now have several options to protect themselves according to the capabilities of their attacker. Bihani told ZDNet that depending on the business' risk appetite, they could scale up their response to an attacker's actions accordingly.

For example, Bihani said that a curious developer might change a few input fields or URL parameters without intending to do any damage, so a company that finds that activity acceptable may allow them continue using their site, but just monitor what they do. On the other hand, more sophisticated honeypot situations could be set up, such as fake access control lists with hashed passwords, and if an attempt was made to break them, the business would know they were under attack by someone who has malicious intent.

Topic: Security

Michael Lee

About Michael Lee

A Sydney, Australia-based journalist, Michael Lee covers a gamut of news in the technology space including information security, state Government initiatives, and local startups.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.


Log in or register to join the discussion
  • Video problems

    Sound cuts out at 0:30. Looks like the video has been hacked.
    • That wasn't meant to happen

      We've taken another swing at it, should be good now.
      Chris Duckett
  • Seems pretty slick

    As veryevilempire points out, the advanced hackers will find a way, but this should help raise the bar on the level of hacking knowledge needed to get anywhere in attacking a site.
  • I like it.

    Being an "old school" hacker, back in the days when it meant what it said: Hacking your system to exceed its design parameters (e.g., Z80 based machines that were faster and had more memory than a bulked-up IBM PC), it distresses me that the word is now used to describe people whose only satisfaction is the sabotage of someone else's system. I wonder, as security keeps increasing, how long will it be before we have sites that are able to "byte back"?
    • byte back

      Well.....some already do "byte back".....for the record....I do BITE BACK.....when someone tries
      to hack my system.
  • Counterattack

    The USAF used to say that the best defense was a good offense, implying that the destruction of the attacker was assured.

    The same principle applies. And the counterattack need not be in the cyber world. It can be a severe physical attack upon the initial attackers.
    • You'd need to be very sure...

      That the retaliation was not against a hacked third party account, whose only 'crime' was not picking a secure password, or who didn't secure their social details.
  • Yeeeeeeeees!

    I am inVINCIBLE! :)