Full Report
Attackers can hide behind residential proxies, VPNs, and other infrastructure that makes malicious sessions appear legitimate to existing edge security controls. Spur explains how session enrichment adds data points that help organizations identify risky sessions and make stronger enforcement decisions. [...]
Analysis Summary
# Best Practices: Session Enrichment & Infrastructure Intelligence
## Overview
Traditional edge security (WAFs, Bot Management, and Identity systems) often fails to detect sophisticated attackers who use residential proxies, VPNs, and anonymized infrastructure to mimic legitimate human behavior. These practices address the "context gap" by enriching live sessions with real-time infrastructure data, allowing organizations to distinguish between a legitimate user and an attacker hiding behind a consumer-grade IP.
## Key Recommendations
### Immediate Actions
1. **Audit IP Reputation Reliance:** Evaluate your current security stack (WAF/CDN) to determine if it relies solely on static "good/bad" IP lists, which are often ineffective against rotating residential proxies.
2. **Identify High-Risk Entry Points:** Map out sensitive endpoints—such as login pages, password resets, and account creation—where infrastructure cloaking (VPNs/Proxies) poses the highest risk.
3. **Baseline "Normal" Infrastructure:** Review logs to understand the typical network origin of your legitimate users (e.g., specific ISPs or geographic regions).
### Short-term Improvements (1-3 months)
1. **Integrate Session Enrichment:** Deploy a session enrichment layer (like Spur Monocle) to add real-time attributes (VPN, Proxy, RDP, Data Center) to every incoming request.
2. **Define Conditional Access Policies:** Transition from binary "allow/block" rules to risk-based enforcement. For example, require MFA if a session originates from a commercial VPN but allow single-factor for known residential ISPs.
3. **Attribute Specific Services:** Move beyond generic "VPN" detection to identifying specific providers (e.g., ProtonVPN, Tor) to better assess intent and risk.
### Long-term Strategy (3+ months)
1. **Contextual Trust Assessments:** Implement a "Session Trust Score" that combines device fingerprinting, behavioral signals, and infrastructure context to make automated enforcement decisions.
2. **AI Traffic Management:** Establish specialized protocols for handling emerging AI-driven traffic (crawlers and agentic AI) to prevent scraping while allowing legitimate automated services.
3. **Governance Integration:** Ensure session assessments include unique IDs and traceable reasons for enforcement to support compliance auditing and false-positive investigations.
## Implementation Guidance
### For Small Organizations
- **Leverage Managed Features:** Use the built-in "Anonymizer" or "Proxy" blocking features provided by your existing CDN or WAF provider.
- **Focus on Logic Targets:** Apply infrastructure checks only to critical authentication points to save on costs and performance.
### For Medium Organizations
- **API Integration:** Use real-time APIs to fetch infrastructure metadata during the authentication flow.
- **Custom Enforcement Rules:** Create a tiered response (e.g., Allow, Challenge with CAPTCHA/MFA, or Block) based on the `service` and `vpn` attributes.
### For Large Enterprises
- **Full Stack Enrichment:** Integrate infrastructure intelligence across the entire lifecycle, from edge (WAF) to application (Fraud Detection) and post-incident (SIEM/SOAR).
- **Automated Policy Tuning:** Use session signals to automatically adjust security posture during high-threat periods or specialized campaigns.
## Configuration Examples
A recommended Session Trust Assessment payload for policy enforcement should include the following attributes:
json
{
"signals": {
"vpn": true, // Is the user on a VPN?
"proxied": false, // Is the user on a residential proxy?
"anon": true, // Is the connection anonymized?
"dch": true, // Is the traffic originating from a Data Center?
"service": "NAME", // Specific provider (e.g., NORD_VPN, TOR)
"ai_agentic": false // Is this an AI agent?
},
"enforcement": {
"action": "CHALLENGE",
"reason": "High-risk VPN service detected at login"
}
}
## Compliance Alignment
- **NIST SP 800-207 (Zero Trust):** Align with the "continuous verification" principle by evaluating the network context of every request, not just the initial login.
- **ISO/IEC 27001:** Supports A.13.1.1 (Network controls) by providing enhanced visibility into the origin of traffic.
- **CIS Controls:** Supports Control 6 (Access Control Management) by ensuring credentials are not being used from suspicious, anonymized infrastructure.
## Common Pitfalls to Avoid
- **Over-blocking Legitimate VPN Users:** Many privacy-conscious users use reputable VPNs. Avoid flat blocks on all VPNs; instead, use MFA to verify the user.
- **Ignoring Data Center (DCH) Traffic:** Legitimate humans rarely browse from AWS or Azure. Traffic from these sources is often automated or proxied.
- **Stale Threat Intel:** IP addresses change owners rapidly. Avoid using offline or weekly-updated IP databases; use real-time session enrichment.
## Resources
- **Spur Monocle Platform:** [app[.]spur[.]us]
- **WAF Best Practices:** [owasp[.]org/www-project-modsecurity-core-rule-set/]
- **NIST Zero Trust Architecture:** [csrc[.]nist[.]gov/publications/detail/sp/800-207/final]