• According to the report, Local File Inclusion remains the most common attack vector, with a 193% year-over-year increase.
• Another emerging attack vector that poses a significant threat to organizations is server-side request forgery.

According to new research from Akamai Technologies Inc., a content delivery network and cloud services provider, application and application programming interface attacks increased by 137% through 2022.

According to the study “Slipping through the Security Gaps: The Rise of Application and API Attacks Against Organizations,” there has been an increase in application and API attacks regarding frequency and complexity as adversaries seek more innovative ways to exploit the expanding attack surface.

2022 was discovered to be a record-breaking year for application and API attacks. The 137% increase is a major concern as organizations adopt more web applications and APIs to enhance their business and increase customer ease of use. According to the report, Local File Inclusion remains the most common attack vector, with a 193% year-over-year increase.

In the research, Akamai researchers also detail several emerging attack vectors, such as Server-Side Template Injections. SSTI is a technique in which attackers exploit notable vulnerabilities such as Spring4Shell, Log4Shell, and the Atlassian Confluence vulnerability. Attacks can result in remote code execution and data exfiltration, posing serious business risks.

Another emerging attack vector that poses a significant threat to organizations is Server-Side Request Forgery. Through 2022, Akamai observed an average of 14 million SSRF attempts per day against its customers’ web applications and APIs.

Broken Object Level Authorization has also been identified as an increasing source of concern. BOLA is a simple but high-risk attack method that allows access to other users’ information.

Other findings in the report included an 82% increase in the healthcare industry attacks because of the adoption of the “internet of medical things” in the healthcare sector, which expanded the healthcare attack surface—because of the proliferation of the Internet of Things connections and the massive data collected from this sector’s equipment, median attacks on the manufacturing industry increased by 76% last year.

Akamai’s Senior Vice President and General Manager of application security, Rupesh Chokshi, said in a statement, “As cybercriminals evaluate who provides the best return on investment based on the level of effort, the value of data, or the likelihood of paying extortion, we often see shifts in attack trends.”

• According to the report, Local File Inclusion remains the most common attack vector, with a 193% year-over-year increase.
• Another emerging attack vector that poses a significant threat to organizations is server-side request forgery.

According to new research from Akamai Technologies Inc., a content delivery network and cloud services provider, application and application programming interface attacks increased by 137% through 2022.

According to the study “Slipping through the Security Gaps: The Rise of Application and API Attacks Against Organizations,” there has been an increase in application and API attacks regarding frequency and complexity as adversaries seek more innovative ways to exploit the expanding attack surface.

2022 was discovered to be a record-breaking year for application and API attacks. The 137% increase is a major concern as organizations adopt more web applications and APIs to enhance their business and increase customer ease of use. According to the report, Local File Inclusion remains the most common attack vector, with a 193% year-over-year increase.

In the research, Akamai researchers also detail several emerging attack vectors, such as Server-Side Template Injections. SSTI is a technique in which attackers exploit notable vulnerabilities such as Spring4Shell, Log4Shell, and the Atlassian Confluence vulnerability. Attacks can result in remote code execution and data exfiltration, posing serious business risks.

Another emerging attack vector that poses a significant threat to organizations is Server-Side Request Forgery. Through 2022, Akamai observed an average of 14 million SSRF attempts per day against its customers’ web applications and APIs.

Broken Object Level Authorization has also been identified as an increasing source of concern. BOLA is a simple but high-risk attack method that allows access to other users’ information.

Other findings in the report included an 82% increase in the healthcare industry attacks because of the adoption of the “internet of medical things” in the healthcare sector, which expanded the healthcare attack surface—because of the proliferation of the Internet of Things connections and the massive data collected from this sector’s equipment, median attacks on the manufacturing industry increased by 76% last year.

Akamai’s Senior Vice President and General Manager of application security, Rupesh Chokshi, said in a statement, “As cybercriminals evaluate who provides the best return on investment based on the level of effort, the value of data, or the likelihood of paying extortion, we often see shifts in attack trends.”

• According to the report, Local File Inclusion remains the most common attack vector, with a 193% year-over-year increase.
• Another emerging attack vector that poses a significant threat to organizations is server-side request forgery.

According to new research from Akamai Technologies Inc., a content delivery network and cloud services provider, application and application programming interface attacks increased by 137% through 2022.

According to the study “Slipping through the Security Gaps: The Rise of Application and API Attacks Against Organizations,” there has been an increase in application and API attacks regarding frequency and complexity as adversaries seek more innovative ways to exploit the expanding attack surface.

2022 was discovered to be a record-breaking year for application and API attacks. The 137% increase is a major concern as organizations adopt more web applications and APIs to enhance their business and increase customer ease of use. According to the report, Local File Inclusion remains the most common attack vector, with a 193% year-over-year increase.

In the research, Akamai researchers also detail several emerging attack vectors, such as Server-Side Template Injections. SSTI is a technique in which attackers exploit notable vulnerabilities such as Spring4Shell, Log4Shell, and the Atlassian Confluence vulnerability. Attacks can result in remote code execution and data exfiltration, posing serious business risks.

Another emerging attack vector that poses a significant threat to organizations is Server-Side Request Forgery. Through 2022, Akamai observed an average of 14 million SSRF attempts per day against its customers’ web applications and APIs.

Broken Object Level Authorization has also been identified as an increasing source of concern. BOLA is a simple but high-risk attack method that allows access to other users’ information.

Other findings in the report included an 82% increase in the healthcare industry attacks because of the adoption of the “internet of medical things” in the healthcare sector, which expanded the healthcare attack surface—because of the proliferation of the Internet of Things connections and the massive data collected from this sector’s equipment, median attacks on the manufacturing industry increased by 76% last year.

Akamai’s Senior Vice President and General Manager of application security, Rupesh Chokshi, said in a statement, “As cybercriminals evaluate who provides the best return on investment based on the level of effort, the value of data, or the likelihood of paying extortion, we often see shifts in attack trends.”

• The Google Cloud Consulting portfolio will initially feature more than a dozen professional services, according to the Alphabet Inc. division.
• Optimizing current cloud environments is the subject of a second group of Google Cloud Consulting services.

The professional service products of Google LLC’s cloud division are being reorganized into a new, centralized portfolio dubbed Google Cloud Consulting.

It follows a year in which Google Cloud increased its financial commitments to expand its professional services business significantly. With the help of the firm’s services, companies may more easily adopt Google Cloud products, train staff members to use them, and create new apps.

Lee Moore, Vice President of Google Cloud Consulting, reported, “The Google Cloud Consulting portfolio provides unified services capability, bringing together offerings, across multiple specializations, into a single place. This includes services from learning to technical account management to professional services and customer success.”

According to the company, the introduction of the Google Cloud Consulting portfolio has two primary objectives.

Its first goal is to make it simpler for businesses to hire experts from the search engine giant. The company claims that customers will have access to a thorough explanation of each service in Google’s catalog and illustrations of how to utilize it. The objective is to streamline the procurement procedure for business customers.

According to the search engine titan, Google Cloud Consulting will make it simpler for partners to collaborate with its professional service teams. Google has a vast ecosystem of associates dedicated to providing consulting services to its clients. A business launching a complex cloud initiative could hire both Google and a third-party consulting firm to assist.

According to the Alphabet Inc. division, the Google Cloud Consulting portfolio will initially feature more than a dozen professional services. The products fall under various categories.

Some services are designed to make it easier for businesses to implement Google Cloud products. The process of implementing Google Workspace is made more accessible by one such service. Another is made to make it simpler to transfer on-site corporate records to BigQuery, the search engine giant’s cloud-based data repository.

Optimizing current cloud environments is the subject of a second group of Google Cloud Consulting services. For instance, company employees can work with an organization to determine whether its cloud environment has weak security settings.

Training options are also part of the Google Cloud Consulting portfolio. It can give administrators at a company the know-how to set up and control Google Cloud environments. More specialized topics are also covered in the training programs, such as how to create applications for artificial intelligence using the Vertex AI toolkit.

Moore stated, “As we look forward to 2023, we’ll continue to expand the service catalog and focus on making it even easier to find and transact these services and further streamline the experience of engaging with our services.”

• Akamai’s new capabilities, introduced at NAB 2023, will help operators monetize video streaming content by lowering and predicting operating expenses.
• The most exciting new feature is Akamai’s improved support for the Consumer Technology Association’s CMCD protocol, which allows device-based media players to submit playback data to Akamai and other CDNs.

Akamai Technologies Inc., a cloud services and content delivery network provider, recently announced new video streaming features, which it claims will help operators deliver enhanced quality and more customized content to viewers.

The new features Akamai announced at NAB 2023, the annual National Association of Broadcasters conference, will enable providers to realize lower and more predictable operational costs, thereby enhancing their capacity to monetize video streaming content.

Akamai announced that its new services are now accessible via Akamai Connected Cloud, a newly launched, immensely distributed edge and cloud platform for content delivery and development that aims to provide viewers with low latency and high-performance experiences.

The most exciting new feature is Akamai’s improved support for the Consumer Technology Association’s CMCD protocol, which allows device-based media players to submit playback data to Akamai and other CDNs. Akamai may employ CMCD to intelligently pre-fetch content, minimizing buffering and improving video startup times. Another benefit is that video streaming companies obtain more solid metrics of the video quality of their users, which helps with reporting and analysis.

According to Jon Alexander, Akamai’s Vice President of Product Management, Akamai Cloud delivers computing capabilities unique in their ability to support cost control, the gamut of development, and viewer experiences. He said, “We’re giving OTT operators a host of powerful new cloud computing functions, scaling them across our global platform and backing them with Akamai content delivery and security services.”

The new cloud services are being presented with extended use cases for the company’s EdgeWorkers serverless solution, which covers rights management, content personalization, and video streaming security demands.

They include new manifest and playlist editing tools that reduce storage needs and expenses for operators while improving user performance. EdgeWorkers can use these capabilities to dynamically modify manifest file characteristics such as resolution filtering, bitrate ordering, and subtitles at the periphery, closer to observers.

Meanwhile, the new program replacement functionality allows operators to deploy more flexible and quicker pre-delivery content stitching for both live and on-demand television. To meet requirements such as rights limitations, companies can insert content into video streams based on parameters such as the user’s geolocation and time of day.

A/B content watermarking consistent with the new DASH Industry Forum specification allows operators to identify and combat live and on-demand piracy.

Finally, Akamai revealed many new media workflow partner solutions certified as compatible with Akamai Connected Cloud. Ateme SA provides video compression and distribution, Capella Systems LLC provides software-based video-on-demand transcoding, encoding, and packaging, and LiveKit provides interactive live streaming and video conferencing.

• In 2021, Cerbos, which is officially known as Zenauth Ltd., raised USD 3.5 million.
• Cerbos Cloud aims to minimize the manual labor needed to manage Cerbos deployments.

Recently, company Cerbos revealed that it had secured USD 7.5 million in seed funding for its open-source platform for controlling user access to applications.

Numerous angel investors joined OMERS Ventures in leading the round. In 2021, Cerbos, officially known as Zenauth Ltd., raised USD 3.5 million. The business from London stated that it would improve its technology using the money from its most recent investment.

The application determines the features users can access when they log in. For instance, a system administrator could need access to more functions than regular business users. Authorization is deciding how and with whom a particular area of an application’s interface can interact.

Cerbos offer the same-named open-source authorization platform. It enables programmers to use YAML, a relatively straightforward programming language, to create policies that specify who can access what application functionalities. Cerbos evaluates the YAML-based authorization policies set by developers when a user login into an application and grants feature access accordingly.

In the past, software development teams explicitly incorporated permission logic into the code files for their apps. In Cerbos’ opinion, that strategy can make software maintenance more difficult. The startup’s platform stores authorization policies separately, allowing developers to modify them as necessary without altering their applications’ fundamental code.

Emre Baran, Co-founder, and Chief Executive Officer, said, “Decoupling authorization makes life easier for both developers as well as product managers and security teams who create the requirements. Once implemented, the developers can focus on the rest of their job without having to deal with every change in access control logic.”

A Cerbos instance loads authorization policies into memory at startup to speed up processing. Keeping data in memory eliminates the need to retrieve it from storage, thereby accelerating the response time of an application. The company’s platform is “orders of magnitude” quicker than competing tools. According to the company, its platform is “orders of magnitude” faster than some competing tools.

The startup has a built-in auditing tool for debugging purposes. The tool logs every authorization request that Cerbos handles, along with the justification for whether it was approved or rejected. Programmers can use the logs to rectify potential application authorization policy problems.

The business claims that hundreds of companies use its platform to handle tens of millions of weekly authorization requests. It intends to generate revenue from the platform by offering a for-profit managed version called Cerbos Cloud. The startup recently announced the service in conjunction with a new funding round.

Cerbos Cloud aims to minimize the manual labor needed to manage Cerbos deployments. Continuous integration and continuous delivery (CI/CD) tool are included. The tool allows software teams to rapidly update the authorization policies of their Cerbos-powered applications, the startup claims.

• A software-defined wide-area network solution called Netskope Endpoint SD-WAN is based on the SASE platform of the business.
• By providing direct access to apps, policy-based virtual private networks do away with the drawbacks of current remote access networks.

Netskope Inc., a cloud security and networking firm, announced the launch of a new software solution called Netskope Endpoint SD-WAN to give businesses safe and optimal access to endpoint devices in any location.

Secure Access Service Edge, or SASE, is a platform provided by 2012-founded Netskope that enables the discovery, visibility, and granular control of both authorized and unauthorized cloud apps. The business secured a sizable USD 401 million funding round earlier this year. Its flagship Intelligent Security Service Edge provides a converged, cloud-based service intended to transform perimeter security while assisting businesses in staying ahead of cloud, data, and network security challenges.

A software-defined wide-area network solution called Netskope Endpoint SD-WAN is based on the SASE platform of the business. It will combine SD-WAN and Security Service Edge capabilities when it becomes generally available later this year, enabling companies to streamline the connectivity of numerous scattered clients and edge devices while ensuring their high performance.

The business claims it wants to address the shortcomings of traditional networking architectures, particularly the clumsy SD-WAN infrastructures that need to be prepared to handle contemporary apps and lead to bad user experiences, inconsistent policies, and insufficient security. Users will enjoy the same application experience and security level using their laptops or other devices due to Endpoint SD-WAN as they would inside the corporate office.

Parag Thakore, Sr. Vice President of borderless SD-WAN at Netskope, said, “Organizations using outdated SD-WAN and security technology have realized they can’t patch their way to a better network, can’t prioritize or secure what they can’t easily discover, and shouldn’t rely on cumbersome SD-WAN architecture that wasn’t built for a highly distributed, cloud-centric workforce.”

One of Endpoint SD-key WAN’s advantages is that it makes it possible for AI-driven operations, which makes it easier to manage devices and applications with automated troubleshooting and insights into end-user experiences. Moreover, it provides excellent performance for voice, video, and data applications, as well as application-aware prioritization and dynamic path selection to address issues with subpar last-mile performance.

Simultaneous connectivity to numerous public and private data centers further improves user experiences. Policy-based virtual private networks do away with the drawbacks of current remote access networks by providing direct access to apps.

A single architecture that extends context-aware zero trust policy controls across the whole network ensures security by giving any remote user, device, and location easy and secure access to any application environment.

To provide a safe, high-quality connection to their applications from any user, device, and place, businesses are placing high importance on unified edge networking and security initiatives, according to International Data Corp. analyst Brandon Butler.

Brandon Butler stated, “Netskope Endpoint SD-WAN brings the benefits of SD-WAN and edge security tools together in an end-user and IT-friendly client format. These tools can be powerful for enterprises and service providers alike to accelerate edge networking and security transformation.”

• The New York-based company, Staytuned, provides a range of software tools for managing online stores.
• Evey Events is one of its applications, and it can be used to manage cancellations and sell event tickets.

A startup called Staytuned Digital Inc., which offers store management software to online retailers, has gotten USD 34 million in debt and equity financing.

Recently, the company made its financing round public. TenOneTen, Rembrandt VC, and over 12 other investors collectively contributed nine million dollars in equity funding to the round. It also got a USD 25 million credit line from Tacora Capital, which can increase later.

Staytuned, based in New York City, offers online store management software. The startup mainly prioritizes websites which utilize the e-commerce platform used by Shopify Inc. Millions of merchants use Shopify’s platform, which handled USD 61 billion worth of transactions in the most recent quarter.

The software suite of Staytuned was put together using a combination of internal product development and acquisitions. The eight tools in the suite cover a range of use cases. Some automate routine store management tasks, while others serve businesses in niche industries like the events sector.

Four of the eight tools are designed to assist online retailers in providing customer discounts. Moonship is a machine learning-powered application used to target website visitors with customized discount offers. Retailers can mark down the price of goods when a customer is about to complete a purchase, thanks to another tool called ADG.

Additionally, the startup provides more advanced features. With the help of one of its applications, Evey Events, retailers can sell event tickets and carry out related tasks like handling cancellations. Customers can create their own product bundles using the Box Builder tool that Staytuned provides.

Serge Kassardjian, Co-founder and Chief Executive Officer, said, “We hope to become the Salesforce suite for e-commerce stores—an end-to-end suite to scale a fast-growing brand seamlessly within the Shopify ecosystem and beyond, where brands want to grow their presence and revenue.”

Nearly 30,000 online retailers use the software suite from Staytuned, according to the company. The startup intends to expand its market presence by acquiring more Shopify applications using the new financing round it recently announced. In order to accelerate its in-house product development efforts, it will also hire more engineers.

One of many startups in the Shopify ecosystem that have raised money in the last 12 months is the startup in question. The creator of a website analytics tool for Shopify stores, Triple Whale Inc., raised USD 25 million last month from investors. Shop Circle Ltd., based in the UK, raised USD 65 million earlier to streamline day-to-day store management tasks.

• The business will increase its investment in product development, speed up its go-to-market plans, and maintain its commitment to providing top-notch customer service with the help of the new funding.
• Over the course of the following year, the company plans to increase its 40-person workforce to 70 employees using the new funding.

A new USD 20 million round of funding has been secured by Strivacity Inc., a startup that aids in managing application login and signup requests for developers.

The investment was described as a Series A2 funding round when it was announced recently. Ten Eleven Ventures joined the round, which SignalFire led. Jack Huffard, a founding member of the cybersecurity firm Tenable Holdings Inc. and Mandiant CEO Kevin Mandia, also made contributions.

Developers can easily add a user account creation form to their applications using the platform that Strivacity offers. Usually, a sizable amount of custom code is needed to complete the task. The startup claims that its platform’s templates and other features speed up the process and lessen the need for manual programming.

Application developers must build a database to store user account information in addition to creating a signup form for customers. That task will also be made easier, according to Strivacity. It offers features for self-service password resets and tools that developers can use to manage user account data.

The platform has the ability to handle login requests in addition to user signups. According to the startup, developers can implement password-based and passwordless login features in applications using its platform. Additionally, it supports single sign-on, a technology that enables employees to sign into several corporate applications simultaneously.

Strivacity has developed a security engine with artificial intelligence to thwart hacking attempts. The engine creates a diagram of how a user typically interacts with an application and spots access requests that don’t fit the pattern. An account may require the user to log in again if it is accessed via an insecure network or at an odd time of day.

Chief Executive Officer and Co-founder Keith Graham said, “We believe simple sign-in journeys are the modern digital doorway to grow customer relationships. That’s why we built Strivacity. We’re 100% focused on creating surprisingly simple customer sign-in journeys, and this new investment will accelerate our strategy and the opportunity ahead of us.”

Over the course of the following year, the company plans to increase its 40-person workforce to 70 employees using the new funding. The new hires will hasten feature development and aid in the company’s go-to-market expansion.

A few months before Strivacity’s funding round, another startup to simplify application access management, Strata Identity Inc., raised USD 26 million. To handle sign-in requests, many applications employ a class of software known as an identity and access management, or IAM system. A platform provided by Strata makes migrating applications from antiquated IAM systems to more modern cloud-based substitutes simpler.

• AWS Supply Chain includes logistics models that automatically arrange inventory records in a unified format, facilitating analysis to address the problem.

AWS Supply Chain, a cloud-based inventory monitoring and forecasting application, was made generally available by Amazon Web Services Inc. recently. It was first introduced at the cloud giant’s re:Invent conference in December.

Retailers must prevent scenarios where a store lacks inventory to satisfy customer demand. They must also watch out that store owners don’t buy more of a particular item than is required. In some cases, excess inventory must be thrown away, which can reduce a retailer’s profit margins.

AWS Supply Chain is designed in such a way that it helps companies avoid such issues. This cloud-based application can map the locations of a retailer’s stores, logistics facilities, and other distribution centers. When you click on a facility, a panel that displays the likelihood of product shortages or overstocking appears.

AWS Supply Chain gathers inventory information from a retailer’s logistics applications to track product availability in the background. Records are frequently kept in multiple formats by these applications. AWS Supply Chain includes ML models that automatically arrange inventory records in a unified format, facilitating analysis to address the problem.

AWS claims the models also produce a data lake to store the gathered data. They can identify supply chain problems and produce remediation recommendations using that data lake.

The app can identify a nearby logistics hub where a product is in stock if a store is about to run out. It occasionally generates not just one but several recommendations for resolving supply chain problems. The application ranks the recommendations to assist supply chain teams in choosing the best course of action.

In a blog post, Danilo Poccia, the Chief Evangelist for AWS in Europe, the Middle East, and Africa, said, “Recommendation options are scored by the percentage of risk resolved, the distance between facilities, and the sustainability impact. Supply chain managers can also drill down to review the impact each option will have on other distribution centers across the network.”

In addition to assisting retailers with inventory issues, AWS Supply Chain can forecast future product availability. It has a tool for forecasting customer demand based on previous sales records and other information. A retailer can use the application’s forecasts to determine whether it has enough inventory to meet future demand and place additional orders as needed.

AWS Supply Chain is now generally available and includes several improvements that weren’t present in the preview version.

The company has facilitated the application’s integration with SAP SE’s S/4HANA enterprise resource planning system. S/4HANA is used by many businesses to store inventory information that AWS Supply Chain can use to monitor product availability. Additionally, the application is getting interface upgrades and an automation feature to help users prepare their data more quickly.