Black Hat , Events , Security Operations

The Inadequacies of Secure Web Gateways in Modern Security

Secure web gateways struggle with modern web attacks because they focus on network traffic rather than browser-level activity, according to SquareX founder Vivek Ramachandran.

See Also: Corelight's Brian Dye on NDR's Role in Defeating Ransomware

This network-centric approach doesn't capture what happens in a user's browser, and Ramachandran said attackers exploit this lack of visibility to launch script-based attacks that secure web gateways can't detect. Architectural shortcomings make it difficult for gateways to handle attacks happening on the browser side since user interaction and dynamic page content play a critical role in delivering threats (see: Can Browser-Native Security Stop Web Attacks?).

"Without having all of these inputs, it is impossible for them to recreate what's happening in the browser, hence making it even more difficult to detect attacks," Ramachandran said. "We feel like the whole network-based proxy architecture unfortunately is not capable of detecting modern web attacks."

In this video interview with Information Security Media Group at Black Hat 2024, Ramachandran discussed:

• The limitations of secure web gateways in identifying browser-side attacks;
• How attackers exploit architectural flaws in gateways to deliver malicious content;
• The promise of browser-native security products for real-time threat detection.

At SquareX, Ramachandran built a browser-native security product focused on detecting, mitigating and threat-hunting web attacks against enterprise users and consumers. Prior to that, he founded the Pentester Academy, which has trained thousands of customers and was acquired in 2021. Before that, Ramachandran's company built an 802.11ac monitoring product sold exclusively to defense agencies.