Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


09:54 AM
Dark Reading
Dark Reading
Products and Releases

Radware's Attack Mitigation Black Belt Challenge Reveals IT Professionals' Strengths And Weaknesses Of Top Security Threats

Pinpoints leading areas of knowledge that IT managers need to improve upon to enhance their attack mitigation proficiency

Radware® (NASDAQ: RDWR), a leading provider of application delivery and application security solutions for virtual and cloud data centers, today announced that common problems with a cloud scrubbing solution, attributes of financially motivated attacks, ineffective deployment of web application firewalls and popular hacktivist attack tools are the leading areas of knowledge that IT managers need to improve upon to enhance their attack mitigation proficiency. These topics were identified based on the results of the company's Attack Mitigation Black Belt Challenge, a five-week contest that provided IT managers with a real-time assessment of their industry expertise of current security topics, including constantly evolving risks, attack techniques and regularly used security and control solutions.

Click here for more of Dark Reading's Black Hat articles.

The Challenge took participants through assessments comprised of 10 cyber security-related questions. All participants began at the novice, or White Belt, level and advanced to higher expert belt levels - Yellow, Green, Red, then Black Belt - by correctly answering increasingly difficult questions. Each round revealed the areas where IT managers need to improve their security expertise most, derived from the subject matter of the questions that were frequently answered incorrectly. Among them were:

More than 63 percent of White Belt participants were unable to correctly identify the most common problem with a cloud scrubbing-solution (Correct answer: The time it takes to start effective scrubbing once the service is initiated). Nearly 60 percent of Yellow Belt participants could not distinguish attributes of a financially-motivated attack technique (Correct answer: Focus on monetizing targeted electronic data, "Loud" aggressive & persistent, single-vector intrusions). Forty-three percent of White Belt participants could not identify the most ineffective deployment of a web application firewall used to mitigate threats (Correct answer: Span-port). Nearly 39 percent of White Belt participants could not select the least favorite tool of the group Anonymous in hacktivism attacks (Correct Answer: Raptor).

"Out of the 383 participants that started the Challenge, nearly 10 percent had the required security expertise needed to complete the four levels and achieve Black Belt Status," said Carl Herberger, Radware's vice president of Security Solutions who also developed and administered the Challenge. "This statistic should be a fire bell to the IT security industry. We hope that this disparity is the catalyst for IT managers and security professionals to pursue professional educational classes that will not only enhance their attack mitigation expertise, but also help them apply that newly developed knowledge to better protect their companies' networks."

The Challenge results did hold some good news, as participants were adept at understanding cyber security issues such as Advanced Persistent Threats, DoS and DDoS attacks.

More than nine out of 10 participants could positively identify attributes of Advanced Persistent Threats (Correct answers: Spread over days and/or weeks, leverage multiple vectors, combine zero-day - known vulnerabilities and reconnaissance). Ninety-three percent of participants could identify the primary cited reason for launching a DoS or DDoS attack (Correct answer: Political/hacktivism). One hundred percent of participants knew that a "denial-of-service" attack is characterized by an explicit attempt by attackers to prevent legitimate use of that service.

"It is imperative for IT managers to have a real-time assessment of their attack mitigation expertise, so they can properly defend their enterprises' networks and applications," continued Herberger. "As the challenge unfolded, the real security experts started to shine with the average scores increasing to more than 95 percent. One of these experts will become the Attack Mitigation Black Belt Champion."

Announcing the Attack Mitigation Black Belt Champion

The Black Belt Challenge Champion will be announced July 25 at a ceremony in Radware's Black Hat USA 2012 booth (# 624) at 7:00 P.M. (PT). The Champion will be selected among the Black Belt-level players who finished all of the rounds in the shortest total amount of time and will receive a package that includes $1,495 towards early conference registration to Black Hat 2013, plus $2,000 towards conference training, and $1,500 cash allowance towards travel and accommodation.

For more information about The Attack Mitigation Black Belt Challenge, please visit the Radware corporate blog at http://www.blog.radware.com.

About the Attack Mitigation Black Belt Challenge

As sources for the questions, Herberger drew from his years of experience as one of the nation's leading authorities on application and network security, as well as from the 2011 Radware Global Application & Network Security Report - research on the state of global cyber security published by Radware's Emergency Response Team (ERT).

Participants had 90 seconds to answer each question. A minimum of nine correct answers was required to pass each round, and players who pass received an email with their digital colored belt for that level along with a special code to advance to the next round. Players had numerous chances to retake the test if needed. Once players passed all five rounds, they achieved Black Belt status, which qualified them to become the Attack Mitigation Black Belt Challenge Champion. The contest ended July 23.

About Radware

Radware (NASDAQ: RDWR), is a global leader of application delivery and application security solutions for virtual and cloud data centers. Its award-winning solutions portfolio delivers full resilience for business-critical applications, maximum IT efficiency, and complete business agility. Radware's solutions empower more than 10,000 enterprise and carrier customers worldwide to adapt to market challenges quickly, maintain business continuity and achieve maximum productivity while keeping costs down. For more information, please visit http://www.radware.com.

Radware encourages you to join our community and follow us on; LinkedIn, Radware Blog, Twitter, YouTube and the Radware Connect app for iPhone®.

Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-03-03
An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to gain write access to unauthorized repositories via specifically crafted pull requests and REST API requests. An attacker would need to be able to fork the targeted ...
PUBLISHED: 2021-03-03
An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to disclose Actions secrets for the parent repository of the fork. This vulnerability existed due to a flaw that allowed the base reference of ...
PUBLISHED: 2021-03-03
An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify the maintainer collaboration permission of a pull request without proper authorization. By exploiting this vulnerability, an attacker would b...
PUBLISHED: 2021-03-03
A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the Gi...
PUBLISHED: 2021-03-03
Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was p...