The first web intrusion deception system that prevents web attackers in real time

Mykonos leading Web Intrusion Prevention System (WIPS) uses deception to detect, track, profile and prevent hackers in real-time. Unlike legacy signature-based approaches, Mykonos is the first technology that inserts thousands of detection points to proactively identify attackers before they do damage – without any false positives.

Mykonos disrupts the economics of a hacking attempt and lures the attacker into a trap. This allows customers to profile the hacker and gather valuable information about the threat they pose in real time.

PCI Compliance

Mykonos Web Security protects web applications, and the only portion of PCI that covers web applications is PCI 6.6.

Solution Overview

Detect

Detect using deception

Mykonos Software’s web Intrusion Deception™ system effectively eliminates false positives because it employs tar traps to detect attacks with certainty. The software inserts detection points into web application code including urls, forms and server files to create a variable minefield.

These traps detect hackers when they manipulate the deception points during the reconnaissance phase of the attack, before they can establish an attack vector.

And because hackers are manipulating code that has nothing to do with the website or web application, the malicious action is certain.

Track

Track attackers beyond the IP address

Mykonos captures an attacker’s IP address as one data point for tracking. But many legitimate users could also be accessing the site from the same IP address—for this reason, Mykonos goes beyond the IP address and tracks attackers more granularly.

Track browser attacks

Attackers using a browser are tracked by injecting a persistent token into their client. The token remains even if they clear their cache or cookies and persists across browsers, including those with privacy control features.

Track software and script attacks

Attackers using scripts and tools are tracked using a fingerprinting technique to identify the machine delivering the script.

profile

Understand attackers and record their attack

The tracking techniques allow us to profile the attacker and record the attack like a DVR. Every attacker is assigned a name and each incident is recorded along with a threat level based on their intent and skill.

Respond

Respond to attackers

Once an attack has been detected, an appropriate response—from a warning, to requiring a CAPTCHA, to blocking a user or forcing them to logout, can be deployed manually or automatically in real-time.