Website Attacks with John Graham-Cumming and Evan Johnson
Easy Prey22 Apr 2020

Website Attacks with John Graham-Cumming and Evan Johnson

Website attacks are very common. They are often not personal, but they can create a mess for website operators. As website owners and operators, we need website privacy and security especially if we are collecting data and personal information.

As I was making more money from my business in 2015, the need for better performance became an issue. I also needed to be able to keep my site up 24/7 and not have to deal with outages. My website started getting sustained 500-bit denial service attacks. I realized very quickly that this was not my expertise, but that is when I began my partnership with Cloudflare.

Cloudflare provides services that increase the security performance of over 26 million internet properties around the world from individual blogs to governments to Fortune 500 companies. Cloudflare offers services to accelerate internet applications and mobile experiences, mitigate DDoS attacks, prevent customer data breaches, stop malicious bot abuse, and more.

Our guests on today's show are John Graham and Evan Johnson. John Graham is a British software engineer and the current CTO at Cloudflare. Evan is a Product Security Manager at Cloudflare.

We talk about attacks on websites, distributed denial of service attacks, and how to protect your own website. If you want to keep your website up and running without skipping a beat, this is a must-listen episode.

Show Notes:

  • [00:58] - Chris is a Cloudflare customer and shares how he became a Cloudflare customer. He shares his history of working with Cloudflare.
  • [03:05] - In 2015 Chris started getting sustained 500-bit denial services attacks. He realized it was not his expertise and he needed help with this.
  • [04:23] - John and Evan share the risks that Cloudflare helps website owners protect against.
  • [05:53] - What things should we worry about as website operators?
  • [07:09] - Evan is recommending businesses move more of their applications to the edge with workers with Cloudflare Workers. It has real security benefits.
  • [08:29] - The big benefit of Cloudflare Workers is that there is no back-end server to overwhelm. It just moves the application to all of their servers.
  • [10:38] - Often hackers are using automated tools to scan websites, so you really want to limit the ability for that scanner to see something. Then they will just move on.
  • [11:39] - Anyone that has a database should prepare for the contingency if you get your database breached. Know your legal obligations in dealing with that especially if you are storing personally identifiable information.
  • [14:01] - With Cloudflare, you can identify a problem and have it blocked almost immediately.
  • [14:58] - It is really hard to patch your website fast enough. So a WAF can give you some breathing room while you patch the back end systems. Everyone should have a WAF, it is an extra layer that can really, really help. A WAF is a web application firewall.
  • [17:16] - If you are connected to the public internet and you provide a service or website Cloudflare can protect that.
  • [18:13] - Use a good password and have two-factor identification.
  • [21:11] - Cloudflare Workers is super flexible and easy to write since you use Javascript.
  • [21:46] - John shares how Cloudflare is able to offer free DDos services to their users.
  • [23:12] - Cloudflare believes that your data is your data. They analyze it for you to provide your analytics and to look for attacks but they don't use your data.
  • [24:34] - Cloudflare is a way to get a level of protection for an inexpensive price.
  • [26:40] - With your back-end servers, you want to make sure you orange cloud things. Cloudflare is seeing the requests and it is being proxied through their network.
  • [28:09] - With Cloudflare's new project Magic Transit they can take over the IP space and become your network. The traffic comes to Cloudflare so they can run the services they provide and then pass the good traffic back on to you.
  • [30:30] - Cloudflare tries to take things that are expensive and complex and make them easy to use and cheap so that everyone gets access to these cool tools.
  • [32:16] - People started to realize that they are using the internet for absolutely everything from banking to dating and it really matters that they protect that and use things that are trustworthy.
  • [32:51] - If there is one password and two-factor you are going to use, put it on your personal email because if someone breaks into your personal email they can probably reset the password on every other service you use. Secure your email first.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

Links and Resources:

Episoder(321)

Art Heists

Art Heists

The world of art theft looks glamorous in the movies, but the reality is far more complicated. From multi-million dollar forgery schemes to undercover FBI operations recovering stolen national treasur...

29 Apr 37min

The Power of Prediction

The Power of Prediction

We make predictions all the time including about the weather, about traffic, about what someone is going to say next. It feels natural, even rational. But when algorithms start making predictions abou...

22 Apr 39min

Privacy vs Reality

Privacy vs Reality

Online security advice often sounds simple until you actually try to follow it. Between password managers, privacy settings, and data brokers, protecting yourself can start to feel like a full-time jo...

15 Apr 58min

Wired to Trust

Wired to Trust

It's easy to think scams only work when someone misses something obvious. In reality, most of them don't look obvious at the start. They show up as normal situations with just enough friction to notic...

8 Apr 41min

Intimate Partner Fraud

Intimate Partner Fraud

Most scams leave a digital trail. A fake email, a spoofed number, a fraudulent website. You can trace them, report them, sometimes even reverse them. But what happens when the scam has no digital trai...

1 Apr 45min

Identity without Passwords

Identity without Passwords

Every day, employees at hotels, restaurants, and resorts across the country are doing exactly what they were hired to do: being warm, responsive, and eager to help. It's what makes hospitality work. I...

25 Mar 38min

When Cybercrime Gets Personal

When Cybercrime Gets Personal

Most security breaches don't begin with sophisticated code or elaborate technical exploits. They begin with a phone call, a convincing email, or someone at a help desk who just wanted to be helpful. T...

18 Mar 45min

Stopping Phone Scams

Stopping Phone Scams

Phone scams get dismissed as background noise or just annoying interruptions and unknown numbers with robotic voices we learn to ignore. But behind that noise is an industry built on psychology, autom...

11 Mar 45min

Populært innen Politikk og nyheter

giver-og-gjengen-vg
aftenpodden
aftenpodden-usa
forklart
popradet
stopp-verden
fotballpodden-2
rss-gukild-johaug
lydartikler-fra-aftenposten
det-store-bildet
nokon-ma-ga
hanna-de-heldige
dine-penger-pengeradet
rss-ness
aftenbla-bla
rss-espen-lee-usensurert
e24-podden
rss-dannet-uten-piano
rss-penger-polser-og-politikk
frokostshowet-pa-p5