Cloud Services Security Vendor Disclosed a 'Security Incident'

Imperva, a cloud-services security company, announced on Tuesday a data breach involving its Cloud Web Application Firewall (WAF) product, formerly known as Incapsula. The August 27th announcement stated:

"... this data exposure is limited to our Cloud WAF product. Here is what we know about the situation today: 1) On August 20, 2019, we learned from a third party of a data exposure that impacts a subset of customers of our Cloud WAF product who had accounts through September 15, 2017; 2) Elements of our Incapsula customer database through September 15, 2017 were exposed. These included: email addresses, hashed and salted passwords; 3) And for a subset of the Incapsula customers through September 15, 2017: API keys and customer-provided SSL certificates..."

Imperva provides firewall and security services to block cyberattacks by bad actors. These security services protect the information its clients (and clients' customers) store in cloud-storage databases. The home page of Imperva's site promotes the following clients: AARP, General Electric, Siemens, Xoom (A PayPal service), and Zillow. Many consumers use these clients' sites and service to store sensitive personal and payment information.

Imperva has informed the appropriate global regulatory agencies, hired forensic experts to help with the breach investigation, reset affected clients' passwords, and is informing affected clients. Security experts quickly weighed in about the data breach. The Krebs On Security blog reported:

"Rich Mogull, founder and vice president of product at Kansas City-based cloud security firm DisruptOps, said Imperva is among the top three Web-based firewall providers... an attacker in possession of a customer’s API keys and SSL certificates could use that access to significantly undermine the security of traffic flowing to and from a customer’s various Web sites. At a minimum, he said, an attacker in possession of these key assets could reduce the security of the WAF settings... A worst-case scenario could allow an attacker to intercept, view or modify traffic destined for an Incapsula client Web site, and even to divert all traffic for that site to or through a site owned by the attacker."

So, this breach and the data elements accessed by hackers were serious. It is another example indicating that hackers are persistent and attack where the money is.

Security experts said the cause of the breach is not yet known. Imperva is based in Redwood Shores, California.

Comments

[dinamarie]

Very well written blog.