Our Defensive Security Blind Spot

Wesley Hales starts from the gap in current defenses. Perimeter tools such as WAFs and API security products rely heavily on signatures and mostly inspect request headers and a small slice of the body, so they miss much of the sensitive data that leaves an environment in responses and outbound calls. He points to recent edge-device exploits and large data leaks as evidence, and describes the data flows in production that go unmonitored, including web submissions, third-party egress and logging.

The core of the talk is an approach that runs inline inside the service proxy, Envoy in his examples, using small WebAssembly modules written in Rust. These modules classify fields such as card numbers, Social Security numbers and bank routing numbers in both requests and responses. Checks include pattern rejects, checksum validation such as Luhn for card numbers, and recognition of structured JSON keys, with asynchronous reconciliation against an existing DLP tool where more certainty is needed. Results are exported to Prometheus and Grafana. A live demo showed spikes in the dashboard when a page containing fake identifiers was loaded. He also covered detecting exploit output, such as command results appearing in responses, and a case study of an airline scraper, where response-based signals enabled rate limiting and the scraper was eventually blocked.

The takeaway is that watching what data services emit, how much, and in what pattern can reveal exfiltration, lateral movement and exploitation that IP reputation and signatures miss. He noted that the components are open source, including a proxy SDK for writing custom classification modules, and asked for feedback on a talk he was giving for the first time.