The latest State of Application Security Report from Cloudflare has revealed some alarming trends in the internet’s threat landscape for 2024. According to the report, malicious internet traffic has increased to 6.8%, up by a percentage point from the previous year. This rise in threats is believed to be driven by wars and elections, with attacks against Western-interest websites coming from pro-Russian hacktivist groups.
One particularly concerning aspect highlighted in the report is the speed at which new vulnerabilities are being exploited. Attackers are now targeting old, known vulnerabilities, and exploiting them at an alarming rate. For example, attackers attempted to exploit a JetBrains TeamCity DevOps authentication bypass just 22 minutes after the proof-of-concept code was published.
Zero-day exploits are also on the rise, with Google reporting 97 zero-days exploited in the wild in 2023. This underscores the importance of patching exploits as soon as possible to prevent cyber attacks. Cloudflare warns that attackers are going after the easiest targets first, so organizations should not delay in applying security patches to protect their systems.
Distributed Denial of Service (DDoS) attacks remain a prevalent threat, making up over 37% of all mitigated traffic. In the first quarter of 2024, Cloudflare blocked 4.5 million unique DDoS attacks, highlighting the scale of these attacks. The sophistication of DDoS attacks is also increasing, with Cloudflare mitigating a massive HTTP/2 Rapid Reset DDoS attack that peaked at 201 million requests per second.
API security is another area of concern, as attackers are increasingly targeting API-related traffic. With 60% of dynamic web traffic now API-related, organizations need to ensure they are aware of all their API endpoints to protect against attacks. The report also emphasizes the importance of securing third-party scripts and connections, as these can pose significant security risks.
Automated bot traffic accounts for 38% of all HTTP requests processed by Cloudflare, with as many as 93% of bots potentially being malicious. While some bots provide legitimate services, others can be used to engage in malicious activities such as scalping tickets or disrupting online services. Protecting against these threats requires proactive measures, including leveraging security defenses from companies like Cloudflare and implementing secure coding practices.
In conclusion, staying ahead of evolving cyber threats requires vigilance and proactive security measures. Organizations and individuals must take steps to protect their online assets and services from malicious actors by implementing robust security solutions and staying informed about emerging threats in the digital landscape.
