Web application firewall

Of course, one thing we've launched recently is our mitigation capability.

Given how quickly in the wild exploitation now happens, we're talking single-digit hours, because we've become, I think, well, uh, well used to kind of reproducing vulnerabilities at scale very quickly, especially now with the advent of AI, we can flip reproduction, so POCs, into WAF rules, IDS, IPS rules, and ultimately then push those automatically once we actually find a vulnerable VPN or mail server or similar.

So ultimately, uh, yeah-

Yeah

Okay, that makes sense.

I can s- absolutely see why someone would pay money for that, 100%.

Um, the other side of this, though, is that there's, you know, you mentioned that there's, like, this WAF component to it, right? Is this a Watchtower-developed WAF that goes in front of an organization's applications, or are you just providing rules for existing WAFs? Like, how does that work?

So, so the big thing for us with mitigation at this point is that the challenge around remediation and kind of moving new things in is stability, availability, change controls for it.

If, um, if they're blocking at the network layer known bad actors, then some of those people don't even get the chance to try to break into your, uh, site.

If they're then looking at requests that are coming in using some sort of WAF and identifying things like potential SQL injection, then even if your plugin h- is susceptible to that, it's maybe still safe.

If they have something like Monarch that runs in the runtime layer that's looking at the behavior of the actual request and saying, "Oh, that looked safe, but what it's actually doing isn't," and it gets shut down there, again, your, your plugin, it doesn't matter if the plugin was vulnerable, it's you're protected anyway.

Um, and, and, and I think that that kind of thing, you know, also things like virtual patching, you know, fixing your plugin for you even though you didn't realize it was needed.

We, we, um, detect and remediate more malware than, than anyone else.

Um, but, you know, you start by removing the malware, and then you say, "Well, how's that getting there?" And you, you know, you sort of move into the, the next layer up, looking at the, the runtime when, you know, PHP is actually writing the file to disk and being able to prevent that from happening.

Um, and then stepping up into things like, well, when someone's doing that several times in a row, we should just block them at that network layer, and so our smart WAF does that.

And so it's, it's really a layered approach for hosts.

It's really low resource, and it means that you're completely covered for all of those user agents.

Um, the other two things that I'd like to mention here, um, is double-checking, like, any WAF systems that you have.

So for example, if you have CloudFair, uh, Cloudflare or Akamai, um, or any other kind of, like, similar web application firewalls, um, that are protecting your site, just making sure that you don't have any settings automatically turned on that you might need to toggle off.

Um, so this could be, like, bot site mode, for example, um, or, or having AI scrapers and crawler toggle off.

Option A, Amazon GuardDuty.

Option B, AWS WAF.

Option C, Amazon Inspector.

And option D, AWS Shield Standard.

Let's pause here.

The correct answer is option B, AWS WAF, the web application firewall.

And here's why it's right.

WAF is a web application firewall that lets you create rules to filter web traffic.

None at all.

Number three, the application layer.

Update your SuperForms and Elementor Pro WordPress plugins right now and tune your WAFs to look for base 64 anomalies to stop a massive wave of automated remote code execution attacks deploying web shells.

Those are the immediate tactical actions to secure your environment today.

But I want to leave you with a strategic thought to mull over as you look at your own network architecture.

We protect more than just WordPress, but obviously WordPress is a big part of that.

And we help hosts keep their users, their end users, safe and secure and malware-free by monitoring the files, the runtime, having a WAF layer, sort of protecting it several different layers along the way.

So is this kind of like a white label solution? You're in talks with hosts, many of which I'm sure we've heard of, but their purchase of the products and services that you sell is kind of white labeled? Yes, they may sell us as their

own security product.

Like you've got these rules and, you know, there's certain rules.

You only get certain capacities per like, I mean, mostly in WAF, not so much in network firewalls, but you know, like it's a thing that is nice to have when you need the metric to know if it's actually being hit or not.

AWS is launching their local zone in Las Vegas.

We talked about it when it was announced, but it's finally ready.