Bahrain, Saudi Arabia
ImpervaProtect your web applications, APIs and the data behind them
Imperva, a Thales company, protects websites and APIs from attacks, bad bots and DDoS, and monitors who accesses sensitive data in databases and file stores.
- Cloud or self-managed
- Cloud WAF as SaaS, or WAF Gateway on your own infrastructure
- OWASP Top 10
- WAF blocks SQL injection, cross-site scripting and similar attacks
- API discovery
- Finds public, private and shadow APIs
- Data security
- Agentless and agent-based data activity monitoring
Problems Imperva is used to solve
Public websites and APIs are attacked continuously. These are the problems Imperva products address.
| Topic | What it can lead to | How Imperva helps |
|---|---|---|
| Web application vulnerabilities such as SQL injection | What it can lead to: Data theft or defacement through flaws in your own code. | How Imperva helps: A web application firewall (WAF) with managed rules that block OWASP Top 10 attacks while fixes are made. |
| APIs nobody has documented | What it can lead to: Sensitive data exposed through endpoints that security teams do not know exist. | How Imperva helps: API Security discovers public, private and shadow APIs, classifies the sensitive data they carry and assesses risk. |
| Bots scraping content and taking over accounts | What it can lead to: Fraud, stolen accounts and competitors harvesting prices. | How Imperva helps: Advanced Bot Protection detects and blocks automated attacks on websites, mobile apps and APIs. |
| Distributed denial of service (DDoS) attacks | What it can lead to: Websites and services unavailable to customers. | How Imperva helps: DDoS Protection absorbs attacks at the edge before they reach your infrastructure. |
| Malicious or compromised third-party JavaScript | What it can lead to: Card or personal data skimmed from your web pages. | How Imperva helps: Client-Side Protection gives visibility and control over the scripts running in visitors’ browsers. |
| No record of who reads sensitive data | What it can lead to: Insider misuse goes undetected and audits are hard to pass. | How Imperva helps: Data Security Fabric discovers and classifies data and continuously monitors who accesses it. |
What Imperva does
Imperva covers two areas: protecting applications and APIs at the edge, and protecting the data stores behind them.
Web Application Firewall
Blocks SQL injection, cross-site scripting (XSS) and other OWASP Top 10 attacks, with rules maintained by Imperva Threat Research and scanning of uploaded files.
API Security
Continuous discovery of APIs, classification of sensitive data such as IDs and card details, and risk assessments tied to the OWASP API Security Top 10.
Advanced Bot Protection
Protects websites, mobile apps and APIs from automated threats such as scraping, account takeover and application-layer DDoS.
DDoS Protection
Protects websites, networks and other assets by stopping attack traffic at Imperva’s edge.
Client-Side Protection
Shows which third-party JavaScript runs on your pages and lets you control it.
Data Security Fabric
Discovers and classifies structured and unstructured data on-premises and in the cloud, monitors access, and provides compliance reports.
Imperva WAF deployment options
Imperva offers its WAF in three forms. The right one depends on where your applications run and where traffic may be inspected.
| Topic | How it runs | Imperva positions it for |
|---|---|---|
| Cloud WAF | How it runs: SaaS, managed through the Imperva management console; deployments can be automated with Terraform | Imperva positions it for: Applications that can route traffic through a cloud service |
| WAF Gateway | How it runs: Deployed and managed on your own infrastructure | Imperva positions it for: Legacy applications that are hard to move, and data sovereignty requirements |
| Elastic WAF | How it runs: Runs in your environment on Kubernetes, with SaaS-based management | Imperva positions it for: Applications already running on Kubernetes |
With a cloud WAF, encrypted traffic is decrypted by the provider for inspection. Check where that happens if you handle personal data under Bahrain’s PDPL or other data protection law that applies to you.
Before you put a WAF in front of your applications
A short readiness check for any web application firewall project. Tick what is in place: nothing you select is saved or sent.
How VirtuThinko helps you adopt Imperva
- 01
Requirements
We can help you write down what you need Imperva to do, including which applications, APIs and data stores are in scope.
- 02
Demo or proof of concept
We can arrange a demonstration and, where it makes sense, a limited trial against agreed success criteria.
- 03
Design and deployment
We can help plan the architecture, integrations and rollout, including change windows and a rollback plan.
- 04
Tuning and handover
We can help tune policies after go-live and hand over documentation and knowledge to your team.
- 05
Ongoing support
Where you want it, we can help with day-to-day administration, upgrades and periodic reviews.
Cloud WAF is a SaaS service that inspects traffic in Imperva’s cloud. WAF Gateway is deployed and managed on your own infrastructure, which Imperva positions for legacy applications and data sovereignty requirements. There is also Elastic WAF for Kubernetes environments.
A WAF blocks common attacks on API traffic, but Imperva API Security adds discovery of undocumented APIs, classification of sensitive data and risk assessment against the OWASP API Security Top 10.
Many bots send requests that look valid, such as log-in attempts or page views, so attack signatures do not catch them. Advanced Bot Protection focuses on identifying automated behaviour, such as scraping and account takeover.
Modern web pages load JavaScript from third parties. If one of those scripts is compromised, it can copy what visitors type. Imperva Client-Side Protection gives visibility and control over these scripts.
Imperva Data Security Fabric discovers and classifies sensitive data, continuously monitors who accesses it, and provides compliance reporting templates. It supports on-premises and cloud data stores, with agentless and agent-based options.
Yes. Imperva is a Thales company, and its website carries Thales Cybersecurity branding.
Explore Imperva for your organisation
Tell us which applications, APIs or data stores you want to protect and where they run. A member of our team will contact you to arrange an initial conversation.