Thales has unveiled new capabilities within the Imperva Application Security platform designed to strengthen protection against business logic threats, specifically targeting Broken Object Level Authorization (BOLA)—the most significant vulnerability highlighted in the OWASP API Security Top 10. This advancement merges real-time detection and automatic mitigation techniques, addressing risky, unauthenticated, and outdated APIs, thereby providing robust defense mechanisms against unauthorized data access and complex logic vulnerabilities. The integrated approach ensures secure operation across both cloud-based and on-premises environments.
Application Programming Interfaces (APIs) are fundamental to contemporary digital ecosystems, enabling businesses to seamlessly connect diverse services, enhance operational efficiencies, and deliver customized user experiences at unprecedented scales. According to Imperva Threat Research, APIs are increasingly central to digital interactions, accounting for 71% of web traffic, and attackers have correspondingly shifted their focus. The research highlighted a sharp rise in API-targeted attacks, with 44% of sophisticated bot traffic now directed at API endpoints compared to only 10% targeting traditional web applications. This shift demonstrates attackers’ growing interest in exploiting APIs, particularly endpoints handling sensitive, valuable data.
At the forefront of API vulnerabilities is BOLA, a severe flaw arising when APIs inadequately verify user authorization, inadvertently enabling attackers to alter requests and gain improper access to sensitive information. Such breaches expose businesses to serious consequences, including substantial data losses, regulatory penalties, compliance violations, and erosion of customer confidence and trust. Addressing BOLA vulnerabilities is therefore a critical priority for safeguarding corporate digital infrastructures.
Highlighting the urgency of API security, Tim Chang, Thales’ Global Vice President and General Manager for Application Security, emphasized that robust API protection is now essential—not merely beneficial—for maintaining business continuity and customer trust. Chang describes Imperva Application Security as effectively closing existing gaps by offering a unified, comprehensive solution capable of detecting intricate business logic threats and proactively blocking harmful traffic, thus redefining standards for API security.
Imperva Application Security leverages a holistic approach, combining sophisticated detection engines with automatic inline responses and adaptive deployment options. This flexibility allows security teams to manage API-related threats efficiently without interrupting application development cycles or degrading the user experience. Imperva Application Security notably offers several key advantages, including a unified platform architecture that consolidates API discovery, risk analysis, threat detection, and mitigation into one streamlined management console. This eliminates operational complexity caused by fragmented security tools across diverse deployment environments.
Moreover, Imperva Application Security employs advanced, real-time detection for BOLA, combining hybrid behavioral analytics and rule-based methodologies to rapidly identify anomalous API request patterns. Endpoints exhibiting suspicious behavior are promptly flagged for immediate defensive action. Complementing these detection capabilities are integrated automated response mechanisms, seamlessly connecting with Imperva Cloud WAF and WAF Gateway platforms. These integrations enable instantaneous response actions such as real-time blocking of malicious API traffic, significantly enhancing operational resilience. Furthermore, integration with external security automation tools facilitates efficient incident orchestration, enabling swift, coordinated responses to emerging threats.
This development represents a strategic advancement within Imperva’s broader “Security Anywhere” vision, an ambitious strategy aimed at providing comprehensive, scalable, and seamless security coverage for applications and APIs in any computing environment. With these enhanced detection and response capabilities, enterprises gain complete visibility into automated threats targeting APIs and access to robust security tools necessary for comprehensive protection against emerging threats like deprecated API vulnerabilities, unauthenticated API risks, and BOLA attacks.
Leave a Reply