Countermeasures and defense

To protect web applications and email services from attackers, the following countermeasures can be adopted:

• Implement proper input validation in the source code of a web application to protect against major injection attacks, such as SQLI and XSS.
• Implement proper session management, such as secured session tokens, to mitigate session-based attacks, such as session hijacking and cookie tampering.
• Set up multi-factor authentication to protect email gateway authentications.
• Set up proper mobility and security for internal domains.
• Disable email relays if not required or implement authentication and disable default users.
• All attachments should be properly scanned for virus-based signatures, and extensions such as .exe, .bat, and .msi should be blacklisted and blocked immediately.
• Domain filtering should be enabled in email gateways.