WHITEPAPER

Sucuri Security
Technical Overview
Product and Service Description

Table of Contents
Sucuri Security

Company Overview

3Products/Service Description
Monitoring

4Protection

4Response

6Backup

7Exhibits
Exhibit A: Holistic Network Diagram (Sucuri Firewall)

8

Exhibit B: DDoS Mitigation

9

Exhibit C: Exploit Prevention

9

Exhibit D: HTTPS/SSL/TLS Support

11

Exhibit E: Installation and Configuration

12

Exhibit F: Performance Optimization and Caching

13

Exhibit G: Infrastructure Security and Compliance

142

Whitepaper - Sucuri Technical Overview

Sucuri Security
Company Overview
Sucuri is a globally-recognized security company, specializing inproviding comprehensive security to website owners. A US-basedcompany founded in 2010, Sucuri maintains a global presencewith employees in over 23 countries distributed across the major
continents to ensure support is accessible 24/7/365. It provides
website security services to over 500,000 customers around theworld, remediates over 700 infected websites a day, monitors over
1.5 million websites and handles over 30 billion unique page views aPeople, Process, andTechnology
There is no single turnkey
solution to security; instead
it’s a combination of people,processes, and technologythat help create a dynamic
and scalable approach tosecurity posture for anyorganization. Sucuri’s products
are designed to reduce amonth.

brand’s risk of a breach

All of Sucuri’s technology is proprietary, built by our team of security

both proactive and reactiveengineers and researchers. The technology is designed to address
the growing online security threats as they emerge. Our team isdedicated to ensuring the confidentiality, integrity, and availability of
every website within the Sucuri network.
At Sucuri, we care and treat every website as if it’s our own. Thesolution we offer is built on three core pillars – protection, detection,and response. We take a defense-in-depth approach to website
security, in which we employ multiple layers of security to provide
the most comprehensive solution available. Combining people,process, and technology ensures that websites are protected andattacks are mitigated as quickly and efficiently as possible.
These pillars allow Sucuri to deploy a defensive solution that stop
attacks before they start. This prevention solution is coupled witha continuous scanning engine designed to identify rogue elementsthat might prove to be indicators of a potential compromise. Sucuri
provides a professional Incident Response Team (IRT) in the eventof a successful attack, giving businesses peace of mind throughour obsessive attention to current and emerging threats within thewebsite security domain.

3

Whitepaper - Sucuri Technical Overview

through the deployment of
mechanisms addressing eachof the elements describedabove. Sucuri’s solution is acomplementary offering thatbolts onto an organization’s
existing security controls,
satisfying a number ofgovernance requirements
while alleviating and enabling
security teams to continue
to focus on their core
responsibilities.

Product/Service
Description
Sucuri provides a comprehensive security solution for websites withthe website security platform. It is comprised of four core functions
designed to provide organizations a holistic end-to-end security
solution for their website needs.

Monitoring
The monitoring technology is a cloud-based Software as a Service(SaaS) early warning system built on the concept of a network-basedintegrity monitoring system. The monitoring system is a remote andlocal (server-side) continuous scanning engine, providing near real-time

Our Incidence
Response Team isdesigned to detect
multiple Indicatorsof Compromise (IoC),
including but notlimited to:•

Malware Distribution•

Blocklisting Incidents•

SEO Spam•Phishing Lure Pages•

SSL Certificates•

DNS Changes

visibility into the security state of a website.
The monitoring feature includes an alerting engine in the event anIoC (Indicator of Compromise) or malware is detected within theenvironment. Appropriate Security Operations Group (SOG) are thennotified to take immediate action by the security IRT.
Activating monitoring requires no installation or application changes.
All sites are added and configured via the Sucuri dashboard. To enable
the server-side scanning, a PHP agent is required at the root of themain domain’s hosting folder, allowing the environment to be scannedfor credit card skimmers, malicious PHP, and other malware on theserver level.

Protection
The Sucuri Firewall is a cloud-based SaaS Website Application Firewall (WAF) and Intrusion Prevention System(IPS) for websites. It functions as a reverse proxy by intercepting and inspecting all incoming Hypertext
Transfer Protocol/Secure (HTTP/HTTPS) requests to a website, blocking malicious requests at the Sucuri
network edge before it arrives at your server. The Sucuri Firewall includes both Virtual Patching and VirtualHardening engines that allow for real-time mitigation of threats with no impact to the website.

4

Whitepaper - Sucuri Technical Overview

The Sucuri Firewall is built on a Content Distribution Network (CDN)that provides performance optimization features to a website. The CDN
utilizes a proprietary approach to caching dynamic and static content

Points of Presence

across all nodes in the network, leveraging AnyCast technology to•

San Jose, California

ensure optimal performance around the world.

•Washington, DC

Additionally, the Sucuri Firewall offers full Domain Name Server (DNS)•

Dallas, Texasservices.

•Chicago, Illinois

The Sucuri Firewall runs on a Globally Distributed Anycast Network•

Miami, Florida(GDAN), built and managed by the Sucuri team. The GDAN•

London, United Kingdom

configuration allows for high availability and redundancy in the event•

Amsterdam, Netherlands•

Sofia, Bulgaria•Frankfurt, Germany•

Mumbai, India•

Tokyo, Japan•

Singaporeof any failures in the network. Sucuri currently manages twelve Pointsof Presence (PoP).
The firewall is supported by the Sucuri Security Operations Center(SOC) which provides 24/7/365 monitoring and response to all attacks.
Features that the Sucuri Firewall offers include:•Mitigation of Distributed Denial of Service (DDoS) Attacks•

Prevention of Vulnerability Exploit Attempts (i.e., SQLi, XSS, RFI / LFI, etc…)•Protection Against the OWASP Top 10 (and more)•Access Control Attacks (i.e., Brute Force attempts)•Performance Optimization•Zero-Day Attack Protection•

Geo Blocking by Country•

Bad Bot Prevention

The Sucuri Firewall requires no installation or application changes. It is enabled via DNS by adding anA record.

5Whitepaper - Sucuri Technical Overview

Increased Performance with thePeople’s CDN
The Sucuri Firewall runs on a Globally Distributed Anycast Network, built and managed by the Sucuri team. Yoursite benefits from high availability and redundancy in the event of network failure.
We focus on useful metrics to optimize speed, like total time, not first byte or server response time. Our growing
network outperforms competitors and offers all the servers you need to get optimal speed and performance.

ResponseThe response system offers a professional Security Incident Response Team (IRT) to respond to all websiterelated security incidents identified by Sucuri and its’ customers. The team is highly trained and capable ofmitigating all website infections and malware-related issues.
This solution exists because of the complex nature of website security. Intrusions occur for a variety ofreasons. Although our various technologies being employed to assist in the prevention of such compromises,
there are elements beyond Sucuri’s control. Examples include poor user/password management or creation,
poor security configurations, and other similar environmental issues.

6Whitepaper - Sucuri Technical Overview

Because of these expanded attack vectors outside of Sucuri’scontrol, the response feature is designed to provide organizations
a complementary team to assist in the identification anderadication of any successful compromises. This includes analyzing
the cause, assisting in the patching of the issue, and restoring theenvironment to operational order.
Our response solution requires no installation or application
changes. However, it does require direct access to the web server /Response addresses
all website infections,including but notlimited to:•Server Level Malware
Infections

application via FTP/SFTP or SSH.

•Backup•SEO Spam Injections•

Malicious User Redirects

The backup system provides operation continuity in the event•

Website Defacements•

Removal of all Backdoors•

Removal of Website

of an emergency. It offers storage of all website files anddatabases in a remote location on Sucuri’s network. In the eventof a disaster, website backups are available to help recover theaffected environment.
Backups require no installation or application changes, only
access to the hosting folder via SSH or sFTP. All sites are added
and configured via the Sucuri dashboard.

7

Whitepaper - Sucuri Technical Overview

Website Malware
Infections

Blocklist Annotations

Exhibit A: Holistic Network
Diagram (Sucuri Firewall)

8

Whitepaper - Sucuri Technical Overview

Exhibit B: DDoS Mitigation
Mitigation of Distributed Denial of Service (DDoS) attacks is a key feature the Sucuri Firewall offers its customers.

Network-Based DDoS (n-DDoS) Attacks (A.K.A VolumetricAttacks)
Sucuri’s approach to mitigating network-based attacks includes investing in resources across all PoP locations.
It’s built on an Anycast network that allows the distribution of all inbound traffic across the network, explicitly
blocking all non-HTTP/HTTPS-based traffic. The current network capacity exceeds 250 Gigabytes Per Second(GPS). Each PoP has multiple 10G and 40G ports from different providers, all designed to absorb and scale tovery large inbound traffic requirements and attacks.

Application-Based DDoS (a-DDoS) Attacks
These attacks are designed to disrupt a website’s availability by attacking the server resources directly. Flooding
a server with requests, an attacker is able to consume local server resources to the point where the server
becomes incapable of responding to legitimate requests. In these cases, the website will become unresponsive.
The order of magnitude can vary; DDoS is measured in Requests Per Second (RPS) and can begin at 100/200
requests per second for many attacks
Sucuri’s approach to mitigating DDoS is part technology, part human, and part artificial intelligence. The firewall
employs technology that allows the team and engine to profile and analyse requests across the entire network,
allowing us to accurately strip malicious requests from benign requests. Additionally, within the Sucuri network
websites can support 600k + RPS per website.

Exhibit C: Exploit Prevention
The firewall prevents remote exploit attempts that try to abuse software vulnerabilities, such as those
identified by the Open Web Application Security Project (OWASP). These attacks may include exploit attempts
against the website directly and target things like injection (e.g., SLQi, XSS, etc.), remote code execution (RCE),
security misconfiguration, remote file inclusion (RFI), and other vulnerabilities.
The Sucuri Firewall uses a proprietary multi-tiered approach to identifying and stripping malicious application
requests.

9Whitepaper - Sucuri Technical Overview

Additionally, the Sucuri Firewall employs a Virtual Patching and Virtual Hardening approach to its mitigation
strategy:

Tier 1

Application Profiling

The first tier uses a deny-all approach andallowlist model, where all requests that don’t fit
an application’s profile are blocked explicitly atthe edge. This profile is built dynamically on thetechnology/CMS a website is using. No third-party
services are used.

Tier 2Blocklist Engine

The second tier uses a custom-built blocklist
signature blocking model built by the Sucuri teamto account for any potential outliers or evolving
threats.

Tier 3

Correlation Engine

The third tier analyzes all requests across the Sucuri
network to profile attacker behavior and apply it
globally to all sites protected by Sucuri. This is alearning engine that proactively applies updates tothe network as the threat landscape evolves.

The effectiveness of the firewall is limited to its ability to see all incoming traffic. The most common evasion
technique is for attackers to attack the origin server directly, which is why it’s important that all direct traffic tothe origin server is restricted to the Sucuri network.

VirtualWith virtual patching, the Sucuri team is able to quickly respond to emerging threats

Patchingwith no impacts to a website. All patches are applied at the Sucuri edge. This isespecially effective for larger organizations with strict security governance on whenand how patches can be applied to a production environment. Custom rules canalso be applied.

VirtualWith virtual hardening, the Sucuri team is able to apply vulnerability-agnostic

Hardening

patches to a website. Hardening can be specific to the CMS ( i.e. WordPress, Joomla!,Drupal, etc) or more generic to a web server (i.e. Apache/IIS).

10Whitepaper - Sucuri Technical Overview

Exhibit D: HTTPS/SSL/TLS
SupportThe Sucuri Firewall is able to mitigate attacks by intercepting all incoming traffic and performing real- time
analysis of all requests over HTTP/HTTPS protocols (i.e., Layer 7 requests). Traffic that is encrypted (i.e., utilizesHTTPS) must be inspected as well.
To achieve this, end-point termination must occur at the Sucuri edge. The firewall, by design, must intercept andanalyse all traffic to be effective. All analysis is done in memory, real-time - there is no storage of the request
packets. The only data that is stored is the metadata of a request in the form of web access logs.
Organizations have multiple options when dealing with SSL:

11

Option 1

Use Starfield DV certs that Sucuri will generate.

Option 2

Use a custom cert provided by the customer.

Whitepaper - Sucuri Technical Overview

Exhibit E: Installation and Configuration
Each function has its own configuration and deployment requirements, but each is designed to be simple andrequire low overhead and engagement. Requirements are as follows:

Protection

Monitoring

ResponseBackup•

No installation required.

•A-record switch via DNS.

•Time to go live is dependent on Time to Live (TTL) value.

•No installation required.

•

Remote Scanning: Domains are loaded into the Sucuri Dashboard via API orDashboard interface.

•Server Scanning: Domain PHP agents are loaded at the root of each website
directory on the web server. **Requires SFTP/FTP/SSH access to load files.

•

Organization can choose to load files on their own.

•

No installation required.

•

In the event of an incident, all Malware Removal Requests are handled andmanaged via the Sucuri ticketing system.

•

Support engagement and SLA is dictated by your agreement.

•Does require access to the server via SFTP/FTP/SSH. Changes might be outlined inyour agreement.

•No installation required.

•Does require access to the server via SFTP/FTP/SSH. Changes might be outlined inyour agreement.

Some agreements include custom support and integration services. Defer to your agreement and accountmanager for specifics pertaining to deployment for each function and associated responsibilities.

12

Whitepaper - Sucuri Technical Overview

Exhibit F: Performance Optimization
and Caching
All static content is cached on each individual regional server whenever possible. This allows for faster responses torequests (500 ms vs 10 ms) and scales (50 concurrent users vs. 200k concurrent users). Standard known CMSs like
WordPress, Joomla!, Drupal and other similar CMS applications use cookies. We’re aware of this and account for it inour caching logic.
The caching feature works by building a cache key. Every request that matches that key gets the same page. Thecache key consists of the HTTP or HTTPS, domain, request URL, and normalized user agent (i.e. mobile, desktop,tablet, or RSS bot). This means that users of different devices (i.e. desktop vs mobile) won’t see the same content.

CDN Caching Options
The CDN offers four means of caching:

OptionDescription

Time

Enabled(Not Recommended
For E-Commerce/Membership Sites)

Caches entire site and only purges cache everyfew hours.

All - 3 hrs +Minimal Caching

Caches entire site and purges cache every few minutes.

200 - 8 m
404 - 2 m
302 - 15 m
301 - 15 m

Site Caching(Site Headers)Caches static content and respects site headers for
dynamic website content.

200 - 180 m
404 - 10 m
302 - 180 m
301 - 180 m

13Whitepaper - Sucuri Technical Overview

Disabled(Use With Caution)

Only caches static files such as images, .css, .js, .pdf,.txt, .mp3 and a few more extensions.

200 - 1 m
404 - 1 m
302 - 10 m
301 - 10 m

Clearing Cache
Clearing (purging) cache is a critical feature of the CDN. We allow cache to be cleared via the Sucuri Dashboard
or the WAF API. Once initiated, the cache propagates through the network and clears all nodes within seconds.

Exhibit G: Infrastructure Securityand Compliance
Every data center we operate from meets or exceeds all standards and compliance regulations:

Compliance Regulations
SSAE16 COMPLIANCE

ISO 9001:2008

OHSAS 18001:2007

ISO 14001:2004

PCIDSS PAYMENT CARD

ISO / IEC 27001:2005 AND 27001:2013

INDUSTRY STANDARD

ISO CERTIFICATION

14ISO 50001:2011

Whitepaper - Sucuri Technical Overview

Network Infrastructure
Sucuri’s network consists of multiple transit providers at each location that are utilized for primary trafficrouting, internal traffic routing, and redundancy.
Utilizing a shared network with a primary and secondary termination for each connection prevents a single
point of failure.

Operations•Daily device vulnerability scan performed internally•

Daily vulnerability and compliance scan performed by third parties•

In-house penetration testing and third-party testing•

Documentation, practices, and continuous employee education•

Firewall change management procedures•

Data classification and ownership•

Incident management•

BCP (Business Continuity Plan) & DRP (Disaster Recovery Plan)

Management And Human Resources

15•

Mandatory security awareness training and review for each employee•

Strict least-privilege access practices throughout teams•

Required non-disclosure & confidentiality agreements•

Background checks and skills assessment•Active management in all aspects of the security community

Whitepaper - Sucuri Technical Overview

Clean and Protect Your
Website Fastsucuri.net | 1.888.873.0817 | sales@sucuri.net© 2023 Sucuri, Inc. All Rights Reserved