Web Attacks and Fraud: Lessons Learned from the Deep End of the Pool
summary
Data from billions of automated attacks shows over 50% of breaches now stem from credential stuffing and access abuse rather than classic OWASP bugs; Shape reports attackers progress from raw network tools to headless browsers to human click farms, and defenders succeed by combining rich device/user signals (even floating‑point math fingerprints), real‑time blocking plus retrospective AI review, and selective 2FA or continuous authentication to avoid customer friction.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:44Sarahs background
- 2:45Dans background
- 5:01Dans passion
- 6:17Types of vulnerabilities
- 7:55Breach root cause landscape
- 10:46How attackers evolve
- 14:10What about 2FA
- 14:57Is 2FA mandatory
- 16:42Is 2FA a good control
- 17:34Continuous authentication
- 18:48Capture doesnt work
- 19:10My experience withCaptchas
- 23:16Collecting signals
- 25:24Knowing your environment
- 28:32AI and ML
- 31:49Mitigation
related talks
29mBecoming You: A Glimpse Into Credential Abuse
51mAutomated Threats: The Rise of Bots and What to Do About It
44mThe Unpatchables: Credential Stuffing Quantification and Classification
26mIntegrating Identity and Fraud
24mSecurity in 2023 and Beyond: Automation, Analytics and Architecture
41mThe State Of Credential Stuffing And The Future Of Account Takeovers
31mLog In Through the Front Door: Automating Defense Against...
27mCommon Application Security Mistakes that Enable Automated Attacks