Account Takeover (ATO) Prevention
VIRTIS keeps user and customer accounts secure
Prevents Account Abuse
The VIRTIS platform includes ATO protection as a core part of its comprehensive web security software suite. It blocks unauthorized attempts to use or discover credentials, access user accounts, compromise active sessions, and other forms of ATO.
Complete Account Security
VIRTIS uses multivariate analysis, identifying threat traffic not only by its source but also by its identity, behavior, and intent. The platform deploys in a dedicated VPC (Virtual Private Cloud) geolocated immediately in front of the protected network, blocking malicious traffic with near-zero latency.
Many Threats, One Security Solution
Modern threat actors use a variety of sophisticated tactics to wage ATO attacks. VIRTIS protects against them all: it prevents credential theft, credential discovery, session attacks, and the abuse of valid credentials.
Prevents Credential Theft
Many ATO attacks are intended to steal credential sets from within the targeted network:
System breaches
Allow hackers to exfiltrate account data
Code and command injection
Allow attackers to discover backend resources for access and exploitation
SQL injection
Allows retrieval of private account data from user databases
Complex system-specific ATO techniques
Penetrate the targeted networks, e.g. SSRF attacks which target cloud IAM services
Prevents Session Attacks
If attackers can take control of an active session, they can change the user’s password, contact information, and other details to take over the account. To accomplish this, cybercriminals can use a variety of techniques to discover session tokens, and then use them to perform ATO:
Man-in-the-Middle (MITM)
Attackers intercept user I/O and sniff the traffic
Cross-Site Scripting (XSS)
Cybercriminals plant hostile scripts within applications, which can compromise users' session tokens.
Cross-Site Request Forgery
Hackers construct malicious URLs; when victims access them, hostile actions are performed within their accounts.
Session Side Jacking
Applications which do not use encryption for all URLs are vulnerable to attackers sniffing the post-authentication traffic.
Session Fixation
Attackers trick victims into authenticating sessions with tokens generated by the attackers.
Malware
Hackers install malware on victims' systems, and then sniff and capture network traffic, including session tokens.
Prevents Credential Discovery
When threat actors cannot steal valid credential sets, they attempt to discover them in other ways, including stuffing credentials and brute-forcing login forms. Modern threat actors can be quite sophisticated in their abilities to evade detection: for example, a single brute-force attack can include millions of access attempts, each of which originates from a different IP address in order to avoid rate limiting.
VIRTIS defeats these tactics by accurately tracking traffic sources, even despite geolocation rotation and other attempts to mask the requestor’s identity. The platform includes granular security ruleset configuration; policies can be defined for broad segments of an application’s traffic, or customized for individual URLs. Policy violations can result in a wide range of configurable responses, from autobanning the requestor to merely monitoring a traffic source’s behavior.
VIRTIS uses a variety of techniques to prevent session attacks from succeeding, including:
Fine-Grained ACLs
VIRTIS provides high-precision ACL (Access Control List) capabilities. For a new deployment, its ACLs exclude 75-80 percent of hostile traffic out of the box; the rate is generally much higher after only a few days of fine-tuning and customization for the applications.
Comm Layer Hardening
VIRTIS can customize request and response parameters within the traffic stream to eliminate a number of common session attack vectors.
Session Monitoring
VIRTIS detects suspicious activity during active sessions (e.eg., a sudden change of geolocation), and challenges users whose activities are suspect.
User Validation
Biometric behavioral analysis verifies that each user's activity is consistent with past behavior.
Prevents Abuse of Valid Credentials
Attackers can obtain valid credential sets via phishing, social engineering, and other methods. They then use the credentials to access and take over the accounts. This is the most difficult form of ATO to prevent, because it does not rely on security holes, malicious inputs, brute-force tactics, or other hostile activity. The attacker simply logs into the application, as the actual user would do.
Nevertheless, VIRTIS can detect and block even this form of ATO. VIRTIS goes beyond traditional approaches to security, and adds a number of additional layers of analysis. It uses UEBA and Machine Learning to build fine-grained biometric behavioral profiles for all legitimate users and customers. The platform learns and understands users’ characteristics, and how they interact with the sites, applications, and APIs that it protects.
VIRTIS uses multivariate analysis to distinguish legitimate users from threat actors, and makes decisions not only according to the traffic source, but also according to each user’s identity, behavior, and intent. A threat actor attempting an ATO will have, unavoidably, a number of different characteristics compared to the actual user. VIRTIS detects these differences immediately.
Furthermore, every attacker must, at some point, deviate from legitimate user behavior. When a hostile actor attempts to abuse an account, VIRTIS blocks the traffic source, preventing further access.
Automatic Protection
VIRTIS analyzes global traffic patterns, identifying and adapting to new attack techniques. As a fully managed platform, VIRTIS is updated immediately as new security policies are issued. Even as hackers develop new attack techniques, VIRTIS provides robust protection, automatically.
Full Traffic Transparency
VIRTIS provides unparalleled insights into your incoming traffic. An intuitive Dashboard displays full details (headers and payloads) of all incoming requests in real time. A comprehensive View Log interface provides the ability to view historical data and rapidly construct sophisticated queries against it, showing patterns and identifying anomalous activity in the traffic stream.
A Complete Web Security Solution
Next Generation WAF
API Security
DoS & DDoS Protection
Advanced Bot Management
Account Takeover (ATO)
CDN Integration
Load Balancing
Automated Resource Scaling
Real Time Analytics
SIEM/SOC Integration
Human Behavioral Analysis
Compliance
