At the last Joomla World Conference in November I had the pleasure of meeting Marc Gaffan, one of the founders of Incapsula. Marc gave a great presentation about Incapsula’s solution. You can see it below. I’m going to give you a little review and then move to the interview with Marc.

The concept

Incapsula behaves like a firewall, protecting your site from all sorts of bad stuff like cross scripting, SQL injections and more.

Incapsula behaves like a firewall, protecting your site from all sorts of bad stuff like cross scripting, SQL injections and more. They have a large, dedicated team of security experts whose only job is to protect your site. They’ll even scan your pages for backdoors and report back to you. Since the average small business can rarely afford even one security person, that’s a great benefit.

And the reports Incapsula delivers are really eye-opening. You will be stunned at the number of hacking attempts that happen on a regular basis against your site, mainly by robots but also by humans.

Incapsula is not hacker-proof

You should know, though, even if your site is behind Incapsula, it’s not 100% protected. You still have to do your due diligence. You still have to close security holes both on your server configuration and on anything you install on top of Joomla. (I’ll include some resources at the end).

The backend of Incapsula has a bunch of tools to help you get the most out of your subscription and to control the alerts you receive.

The difficulty of set-up varies

Setting up Incapsula can be challenging — or easy — depending on the complexity of your site. You may have to tweak your email accounts, FTP and get a new SSL (it’s included free with your membership). It might take you a little bit of time to get everything up running smoothly again. Incapsula will send you a number of emails that explain the steps you need to take. I recommend that you read them all carefully and follow the instructions.

Marc Gaffan, Co-founder, Incapsula

And now over to Marc Gaffan:

Marc, what is Incapsula?

Incapsula is a cloud-based service that protects and accelerates websites. Through a simple DNS change, your website’s traffic is seamlessly routed through Incapsula’s globally-distributed network of high-powered servers.

Incoming traffic is intelligently profiled in real-time, blocking even the latest Web threats: from sophisticated SQL injection attacks to scrapers, malicious bots, intruding comment spammers and thwarting multi-Gigabit DDoS attacks.

Meanwhile, outgoing traffic is accelerated and optimized with Incapsula’s global CDN for faster load times, keeping welcome visitors speeding through.

What made you start Incapsula?

Until recent years, website security and acceleration was accessible only to the big companies, those with financial resources and IT departments capable of handling the configuration and management of appliance-based solutions.

New cloud technology that has emerged over the last few years has allowed services like Incapsula to create affordable and easy-to-set-up website security and acceleration solutions. This is definitely a growing need by SMB’s today who have to make sure that their sites are always online and protected but do not have the time or money to handle it themselves.

What are the top three benefits of Incapsula?

1. Website Security – Instant Virtual Patching:

Incapsula’s unique bot detection technology and Web Application Firewall technology protect Joomla websites from intruding comment spam, fake registrations, site scrapers and other threats. Leveraging a unique crowd-sourcing security model and an extensive real-time knowledge base of website attack patterns, new vulnerabilities are quickly detected and virtual patches are released to mitigate these threats.

2. Website Performance – Global CDN & Optimizer:

Incapsula’s global CDN improves website performance by caching and optimizing its content, and delivering it directly from the Internet’s backbone. On average, websites using Incapsula are 40% faster and consume 50% less bandwidth.

3.Advanced Analytics – Traffic, Performance and Threat Statistics:

Incapsula’s dashboard includes live stats for all website traffic, including human visitors, bots, performance statistics and detailed threats reports.

What does your Joomla extension do? Do I need to install it to use Incapsula?

Any Joomla site owner can sign up to Incapsula through our website and set up their website through our online management console.

Our newest Joomla component enables site owners to do all of that and manage their security and performance directly from their Joomla admin without using the management console.

What are some of the unique challenges Joomla users have when it comes to security?

I think that anyone using open source CMS platforms is exposed to many security vulnerabilities that are detected from time to time on different versions. The extensions installed on CMS websites also suffer from vulnerabilities, so users finds themselves in constant concern that their website may be exposed to different threats.

Obviously patches and new Joomla versions are released to overcome vulnerabilities, but it requires the user’s time and efforts each time a patch needs to be installed or a version upgrade is required.

Can Joomla users protect themselves from hackers without Incapsula by using Joomla tools like RS Firewall? What added benefits does Incapsula have that those tools lack?

Joomla users defend their websites by using different extensions such as RS Firewall, but Incapsula’s advantage is the fact that it’s an external service that constantly updates with the newest threats and makes sure the website is protected at all times. In addition, you need to remember that traffic to the protected website is routed first through Incapsula’s servers. This means that attacks are stopped at Incapsula’s side and never even get to the protected website. That is something which is unique to Incapsula.

In addition, Incapsula provides a PCI DDS Compliant WAF, which is the highest widely recognized standard for Web Application Firewalls.

And last, remember that Incapsula doesn’t provide websites just with security but also accelerates websites with our CDN and optimization technology

I feel like your security team works for me, which is cool. What can you tell me a about their work routine and function?

Incapsula keeps a dedicated team of security engineers 24/7 who monitor all the websites under our protection. Once a new threat is detected, we learn the threat and immediately deploy a new security rule protecting from it. This is something you get only with a cloud-based service like ours.

Do you ever hire hackers?

No, we do not.

How do the people in your security team work to find new vulnerabilities?

In three ways:

– We get information from our community members who alert us about new vulnerabilities that

they have heard of or encountered.

– We monitor the thousands of websites under our protection and detect attempts

to exploit vulnerabilities in these websites.

– We proactively look at all the online resources where you can find information about new

vulnerabilities: forums, blogs, etc.

What are the top countries for hackers?

Well, the bigger the country the bigger the number of hackers, so you can see lots of hackers from China, the U.S., Russia, U.K., etc. But you can also see lots of hackers from smaller countries as South Korea, Israel, Denmark and more.

The feature that surprised me the most was the spam blocking. We used to get dozens of spam posts on our forum. Since we moved to Incapsula, we only got one, which makes us very happy. How does the spam blocking work?

We developed a unique bot classification and detention technology which is based on several layers of protection and on our existing and ever-growing bot signature database. When filtering human visitors from bots (and good bots from bad bots) we will look at signatures, HTTP headers and even behavior patterns. We will cross-verify these signals to gain an initial “first impression” and when still not 100 percent sure, we will perform a series of seamless tests (i.e. JS challenge and Cookie challenge). This process will accurately identify 99.9 percent of all bots and our users can turn up their Security setting to provide CAPTCHA challenges to the remaining 0.01 percent. Upon identification, every new bot signature is aggregated across the network to benefit all users, who become instantly immune, even from the latest threats.

It almost seems like fighting with hackers is pointless because they will always be a step ahead of us. That’s why I believe Incapsula and similar services will become the standard for websites in the not-so-far future. Do you see a future where every website out there is protected by a service like yours? Is it even plausible? Will it make your service stronger or weaker if most websites use it?

That’s actually a very good question. Obviously today a website owner can’t really keep up with all the different types of attacks that emerge every day, and we do already see millions of websites using services like Incapsula. This trend will only grow over the next few years.

From our point of view, the more websites we protect the smarter we get and the better our website protection becomes. Our system constantly detects bots and threats that arise against any website on our network. This means that Incapsula continually learns and that every site, regardless of size, makes the system smarter.

What words of advice do you have for Joomla users when it comes to security?

Accept the fact that the days when installing patches every time a new vulnerability arises are over. Website owners simply do not have the capacity today to monitor new threats and make sure their websites are protected from them. Use security services as Incapsula which do the work for you. As one of our customers put it: “Incapsula is like hiring a System Administrator that never sleeps.”

Thank you Marc!

Marc’s Presentation:

[youtube]http://www.youtube.com/watch?v=pdkdr398xfk[/youtube]

***

To find out more about Incapsula, visit http://www.incapsula.com/. To learn more about their Joomla extension visit this page. You can find more details about their Joomla extension here.

Here are some security resources:

Joomla Security Check List: http://docs.joomla.org/Security_Checklist

Security Checklist/Getting Started: http://docs.joomla.org/Security_Checklist/Getting_Started

Fridge Magnets!

The Joomla team  recently announced Joomla 1.7 is now stable for live sites.  This new version fixes a variety of issues with Joomla 1.6 as well as introduces the ability to upgrade to future versions from within the Administrator panel.

No more uploading via FTP, hooray!

This marks the first step towards a upgrade system that is similar to WordPress, thus making your life as an administrator easier.  The Joomla 1.7 release does not bring a huge amount of changes, but it is a vital step in the right direction for Joomla and it’s new release schedule.  In this article I will cover what is new, if you need to upgrade, and why I used such an ugly graphic for this post.

What are the newest and biggest features?

• One click upgrades – Starting from Joomla 1.6 you can upgrade your install by going to:  Extensions -> Extension Manager -> Update -> Find updates.
• Faster release cycles – Short term releases will be changing every six months and only supported for one month after the next release.
• Multi-Language improvements – Associate menu items to different languages.

There are a variety of other minor changes that you can review on the official Joomla 1.7 page.

Thank you Joomla

Do I really need to upgrade?

Depending on what version of Joomla your site(s) are on now, this may be the last time you have to do a “scary upgrade”.   Scary meaning doing it all via FTP and hoping you didn’t miss any upgrade instructions or caveats.  Upgrading is really easy since J1.6, so this shouldn’t be a huge deal.

It’s also important to note that Joomla 1.6 will go end of life in August 2011.   That means no more security updates or patches or fixes for vulnerabilities.  If your site get’s hacked 6 months from now due to some kid developing some obscure technique, you will only have yourself to blame–not Joomla.  Upgrade them sites!

I am on Joomla 1.5.  How do I do it?

There is no upgrade path from J1.5 to J1.6 or J1.7.   You will have to migrate.  There are a variety of changes from J1.5 to newer versions including changes to tables and the ACL (access control list) so a migration is the only way.  If you are comfortable with migrating from different Joomla releases you probably have a system in place.   If not, you can try out this extension.  I personally have not tried it, but it seems pretty straightforward.  Take all the usual precautions and backup your databases and files before doing something like this.   Try it on your development site first and test the process before doing it on a live site.

I am on Joomla 1.6.  How do I do it?

It’s easy peasy if you already made the leap to Joomla 1.6.   Just go to: Extensions -> Extension Manager -> Update -> Find updates.

What’s up with that ugly Joomla image you used in the beginning of the article?

Kids refrigerator magnets are cute, cheap and fun.  They also stick to anything metal.  Slapping some fridge magnets on a whiteboard or something metal or *gasp*, your actual fridge is a good way to nag yourself that this upgrade is very important and needs to be done soon.

Do I have to worry about extensions breaking?

As with any upgrade there is always the potential for things to break.  You should never do a upgrade or migration without some tested and proven way to revert back to a working site if it all goes pear shaped.   The changes from J1.6 to J1.7 are pretty minor, but ther are so many extensions that do so many things, it’s hard to make a blanket statement.

In regards to iJoomla products, we have fully converted iJoomla AdAgency, iJoomla SEO and iJoomla Surveys as of July 28th 2011.

How about you?

Do you have any tips or tricks I didn’t cover? Let us know in the comments, we would love to hear from you.

So some details…

• iJoomla Digistore report found here – we have tested it and found this is not a threat. There was no need to release a new version.
• iJoomla Search & Archive report found here – we have tested and found that the problem is real and we’ve released a new version with a fix for both Joomla 1.0 and Joomla 1.5 versions. You can download an upgrade here.
• iJoomla News Portal report found here – we have tested it and found this is not a threat. There was no need to release a new version.
• iJoomla Magazine report found here – we are currently looking into this problem and if there is indeed a problem, we will release a new version with a fix ASAP.