Aspect	Threats	Impact	Countermeasures	IWS Protection
People	Intentional or unintentional data leaks by employees to public GenAI models	Loss of customer data/ PII and FI secrets Regulatory consequences and reputational damage	Conduct awareness campaigns Implement data classification for data which can be entered into GenAI models	Prevents failed countermeasures' compromised sensitive information, found in the web servers' outbound HTTP traffic, from reaching the public through deep detection of sensitive information Once compromised information is detected, IWS will send a HTTP redirect response to the browser, redirecting the visitor to a pre-configured sanitized error page
Process	Vulnerabilities or security weaknesses in in-house developed GenAI models Risks of supply chain attack arising from the use of third party or open-source GenAI models	Data Leakage leading to loss of sensitive information Backdoors and in-built vulnerabilities	Adopt security best practices while developing GenAI models Conduct third-party provided or open-source GenAI model risk assessment
Technology	Inability to detect unusual user inputs Bypass of GenAI model guardrails	Loss of sensitive information Data Leak of PII Reputational damage	Implement DLP tools and firewalls for GenAI models to mitigate loss of confidential data to GenAI models Introduce controls while developing and using the GenAI models Conduct vulnerability assessments and security testing on GenAI models

Aspect

Threats

Impact

Countermeasures

IWS Protection

People

Intentional or unintentional data leaks by employees to public GenAI models

Loss of customer data/ PII and FI secrets
Regulatory consequences and reputational damage

Conduct awareness campaigns
Implement data classification for data which can be entered into GenAI models

Prevents failed countermeasures' compromised sensitive information, found in the web servers' outbound HTTP traffic, from reaching the public through deep detection of sensitive information
Once compromised information is detected, IWS will send a HTTP redirect response to the browser, redirecting the visitor to a pre-configured sanitized error page

Process

Vulnerabilities or security weaknesses in in-house developed GenAI models
Risks of supply chain attack arising from the use of third party or open-source GenAI models

Data Leakage leading to loss of sensitive information
Backdoors and in-built vulnerabilities

Adopt security best practices while developing GenAI models
Conduct third-party provided or open-source GenAI model risk assessment

Technology

Inability to detect unusual user inputs
Bypass of GenAI model guardrails

Loss of sensitive information
Data Leak of PII
Reputational damage

Implement DLP tools and firewalls for GenAI models to mitigate loss of confidential data to GenAI models
Introduce controls while developing and using the GenAI models
Conduct vulnerability assessments and security testing on GenAI models

Support Business

Build customer and public confidence in web-based services

Protect Business Value

Avoid regulatory penalties and reputation restoration costs

Support Information Security

Compliment other security systems to lower the overall risk of information leakage

Support Application Development

Identify potential information leakage during application development

Support Operations

Compliment existing QA tools to identify potential information leakage

Standalone Machine

IWS is not a SAAS product it is a standalone machine.

Protection against:

Protection Options

Static Code Analyzer

Common Data Loss Prevention Products

iNSIGHT for Web Server

Information leakage due to compromised web servers via internal sources

Infection / Transmission of malicious code to visitors

Data leakage due to application vulnerabilities

Information leakage due to server errors or misconfiguration

Information leakage due to malicious or accidental uploads

Public disclosure of defaced web server

Type of Defacement

Protection Options

File Integrity Solution

Defacement Scanners

Human Monitoring Services

iNSIGHT for Web Server

Defacement content is stored in files on web site, such as HTML, JSP, ASPX, PHP and etc.

Defacement content is stored in database used by content management systems, such as Sharepoint, Sitecore, Joomla, Wordpress and etc

Defacement content is shown conditionally, such as shown to search engines only, referrals from search engines, mobile users and etc.

Defaced content in newly added files, without links from any existing pages, which constitutes the No. 1 type of defacement on Zone-H.

Transient cross-site techniques using scripts, layers, frames to display defaced content from external sites, for e.g. SG PMO and Istana defacement in 2013.

Transient reflected defacement where defacement input is reflected in the response page from the vulnerable website.

Real-time protection to block defaced content from being shown or display the last known good copy even after the web page is defaced in less than 5 seconds.

Restore the display of non-defaced, non-malicious or non-leaky content and preserve forensics evidence on the affected web, app or database servers without restoring content automatically, hence preserving admissible court evidence for legal proceedings.

Protect post-authenticated pages, such as dashboards.

Protect non-HTML content, such as Restful API, SOAP XML and others, which are commonly used to support mobile applications.

Why is it important to have a outbound security system like IWS on top of other existing inbound security systems, such as Web Application Firewall (WAF) or Intrusion Prevention System (IPS)?

Existing security systems provide good protection against incoming attacks from external sources. IWS complements such systems by extending the protection profile to include protection against outgoing information leakages.

Although some WAFs are able to scan outgoing traffic, their ability in this area is very limited. This is understandable as WAFs are primarily focused on incoming threats. For instance, though some WAFs claim they can detect sensitive information such as credit card and Social Security numbers, they are not able to detect presence of such information if the information is contained in common document formats such as Microsoft Office or PDF files. In addition, WAFs are usually not able to detect presence of leakages of source codes as they are not equipped to distinguish between source codes and normal English text. For these areas, IWS has made use of patented technologies to achieve what WAFs cannot do.

For IPS, again as their name implies, their focus is in protecting against intrusions, not leakages.

Likewise, existing WAF or IPS solutions cannot prevent defaced or maliciously compromised web pages from being shown to the public, while IWS can.

Hence, IWS complements WAFs and IPS to provide a more comprehensive protection to your organisation.

Please access the Comparison Matrix for a more detailed comparison.

What are the various types of content supported by IWS? Can IWS be easily customised to detect specific type(s) of sensitive data if necessary?

Out of the box, IWS protects against:

a. Leakage of source code
b. Leakage of software debug messages
c. Leakage of system configuration
d. Leakage of personal information
e. Leakage of financial information
f. Leakage of healthcare information
g. Display of defaced/hacked web pages
h. Display of maliciously compromised web pages

IWS also allows users to detect other types of sensitive information, without the need to learn a new scripting or programming language. Customised detection logic can be added via web-based custom editor.

Can tightening of quality control in web servers related activity (pre and post implementation) eliminate the need for IWS?

Good quality control processes and procedures are important and should still be implemented and followed even when security systems are present.
On the other hand, just as no one will say that good development processes and procedures can remove the need for web application firewalls, tightening of quality control does not remove the need for a information leakage system for web servers.
From our research, there are 4 main causes of information leakage from web servers:

a. compromised web servers
b. web application errors
c. server errors
d. sensitive documents left on web servers

At best, we expect good quality control can reduce the risks from server errors and sensitive documents left on web servers. Leakages due to compromised web servers or web application errors may not be that easily detected by quality control processes.

Why is iNFOTECT focused on detecting leakages from web servers? Can I use IWS to monitor other servers eg. email / instant messaging servers?

IWS only provides information leakage protection for web servers. Depending on the market conditions, iNFOTECT will decide whether to develop a similar product for email servers and instant messaging servers.

Where should I deploy IWS in my organization?

IWS is usually deployed “in front” of the web servers it is protecting, hence it is situated between any existing network firewall/web application firewalls/intrusion prevention systems and the web servers.

As IWS can be used to protect Internet-facing and Intranet-facing web servers, it can be located in the same network segments where these servers are located.

Will IWS affect overall network throughput?

IWS products are designed to sustain high throughput. With IWS running in interception mode, user experience can even be better due to the high performance proxy cache and load balancing features within IWS. With IWS in monitoring mode, there is no impact as IWS will be situated in an out-of-band segment.

How should I deploy IWS if there are multiple web servers distributed over various locations in various countries?

As a best practice, it is recommended to deploy IWS nearer to where the web servers are located. Hence, in a distributed web server architecture with different access gateways to the Internet, multiple nodes of IWS should be deployed to the distributed sites while still remain centrally-managed via a secure web-based management console.

If all the distributed web servers shared a common gateway to the Internet, one can choose to deploy more advanced models of IWS, which are built to support very high throughput, near the common Internet gateway.

iNSIGHT for Web Server

Outbound security appliance for web services to protect against information leakage and defacement

Patented Technologies

Better Compliance

High Performance and Availability

IWS provides a crucial last line of defence against compromised outbound sensitive data from GenAI countermeasures failure.
GenAI firewalls and countermeasures alone are currently not fully able to prevent outbound data breaches should malicious compromises occur.