Skip to content

Wake up, CISOs: You need an ADR flashlight to see into critical application blindspots

By David Lindner, Chief Information Security Officer

October 17, 2024

Thought Leaders MTTR ADR zero days dwell time

    
Wake up, CISOs: You need an ADR flashlight to see into critical application blindspots

Good cyber defense involves more than blocking and tackling. Without visibility into what’s happening, where and by whom, enterprises are hard-pressed to maintain solid protection of systems, networks and data. One area where visibility falls short of what you need is the application layer. This obscurity has given rise to a groundbreaking new breed of must-have detection and response solutions: Application Detection and Response (ADR). 

In today's increasingly sophisticated cybercrime landscape, protecting an organization's most valuable digital assets is more challenging than ever. That's why ADR is absolutely critical. Let me explain.

According to a September 2022 Ponemon Institute survey, 66% of respondents reported a backlog of more than 100,000 vulnerabilities, and that the average number of vulnerabilities needing to be remediated was 1.1 million. This is a staggering figure that leaves organizations vulnerable to costly and destructive attacks. Why is this? The surprising truth is that CISOs today have limited knowledge about the security of their organizations’ applications and application programming interfaces (APIs). They can tell you whether their teams are finding vulnerabilities and whether they’re fixing those vulnerabilities, but that’s about it. 

Current tools offer little visibility into what’s happening in the application layer, creating a significant blindspot. Perimeter protections like web application firewalls (WAFs) can be helpful, but they often lack contextual awareness to detect subtleties that reveal a lurking threat. Extended detection and response (XDR) solutions similarly lack visibility in production applications and APIs. 

Check out our video to see how ADR trains a spotlight
on the app-layer blindspot. 

The application layer, comprising server-side applications and APIs, is critical for security, given its important role in business operations. This essential layer handles all company data, including sensitive data like personally identifiable information (PII) and personal health information (PHI). It is typically connected with databases and other applications that can operate outside the organization. Cybercriminals are increasingly targeting this blindspot, as evidenced by the rising number of application-layer attacks. 

Several recent examples point to this trend. Take the 2021 attack on Kaseya, an IT solutions provider. In that instance, attackers used authentication bypass and SQL injection techniques at the application layer to target Kaseya's customers. The impact was far-reaching, costing the company roughly $70 million in ransomware payments and affecting between 800 and 1,500 downstream businesses.

If ADR had been in place, that costly attack — and countless others like it — could have been averted.

Closing the application layer gap with ADR

Stated simply, ADR is the answer to much-needed application layer detection and response capabilities. With in-app agents continuously monitoring security-relevant application behavior while the code runs, ADR detects anomalous behavior across the application stack.

It can also detect open-source and custom code vulnerabilities that manifest only in production. Taking an "inside-out" approach enables ADR to spot evidence of zero-day attacks that XDR and WAFs miss and to transmit threat data to the security operations center (SOC) for incident response workflows through a security orchestration, automation and response (SOAR) or other platform.

Every month, ADR stops tens of thousands of attacks.
Take a look at the numbers.

An ADR platform can also feed vulnerability and attack data to security information and event management (SIEM), XDR, and cloud-native application protection platform (CNAPP), giving SOC teams unhindered visibility with just one tool.

Three critical security capabilities of ADR

  1. Reduce risk and impact of attacks: Application-layer visibility can improve detection and response to threats in runtime applications, reducing the organization's overall cyber-risk exposure. ADR enables enhanced mitigation of significant threats such as zero days and advanced persistent threats (APTs) that hide at the application layer and shines the light on attackers lurking there. As a result, CISOs can reduce the attack surface and shrink the business impact of cybersecurity incidents.
  2. Decrease attacker dwell time: The longer an attacker goes undetected, the greater the potential for data breaches and other disruptions. ADR spots attackers persisting in the application layer so action can be taken to stop them from penetrating other systems. ADR also detects vulnerabilities in the code — both known and unknown — thereby enabling teams to remediate them before they are exploited, thus reducing the organization’s risk exposure time and scope and strengthening its security posture.
  3. Accelerate response, lessen resolution times – ADR can reduce the mean time to respond (MTTR) by identifying threats early at the application layer and giving SOC analysts enriched data so they can react quickly. ADR data can also feed into SOAR platforms and inform automated incident response playbooks. The solution can automatically block attacks at the application layer to prevent an attack from spreading. 

Read more about why Contrast is making the case for ADR.

CISOs must confront the urgent reality of application-layer blindspots now. As cybercriminals increasingly exploit this critical weakness, ADR isn't just an option, it's an essential defense. Offering unparalleled visibility, precise detection and swift response, ADR is the key to neutralizing the sophisticated threats hiding within your applications. It exposes hidden attackers, slashes dwell time, and accelerates response efforts. ADR doesn’t just protect the application layer — it transforms it from your greatest vulnerability into your most robust defense. Your organization’s security future depends on it.

To learn more about how ADR technology can protect your organization, request a demo of Contrast Security ADR to see its capabilities in action.

Get a Demo

Read more: 
Thought Leaders MTTR ADR zero days dwell time
David Lindner, Chief Information Security Officer

David Lindner, Chief Information Security Officer

David is an experienced application security professional with over 20 years in cybersecurity. In addition to serving as the chief information security officer, David leads the Contrast Labs team that is focused on analyzing threat intelligence to help enterprise clients develop more proactive approaches to their application security programs. Throughout his career, David has worked within multiple disciplines in the security field—from application development, to network architecture design and support, to IT security and consulting, to security training, to application security. Over the past decade, David has specialized in all things related to mobile applications and securing them. He has worked with many clients across industry sectors, including financial, government, automobile, healthcare, and retail. David is an active participant in numerous bug bounty programs.

Previous

September attack data: Spotlight on path traversal, one of the gnarliest application attack types