Question 1

Verifications, Profiles, Session Visibility and Control

Accepted Answer

This guide walks you through the required configuration to populate the verifications, sessions, and profiles sections within the Cymatic app.

Once the steps outlined below are completed, you will gain insight into authentication submissions, user-level analytics for how the user base interacts with your web app, risks presented by your authenticated user base, and the capability to log an authenticated user out of your web application if necessary.

Upon completion of this guide, you will gain user-level session visibility and control, insight into various risks your authenticated user base is exposing your web application to, user-based profile information, and user-based session history.

${color}[#f15a23](Step 1: Create a cookie in your web application)

|| For Cymatic to track user authentication and behavior, a cookie is required. Due to the amount of customization options available when creating a cookie, it is typically easier to create a new one for Cymatic to use as opposed to leveraging an existing cookie. Although an existing cookie more than likely exists on your web app, if certain parameters have been modified, it may cause unexpected results within the Cymatic app. || There are numerous different languages that can be used to create web applications. Cymatic does its best to provide documentation for all available languages. If your web app is written in a language that is not documented in this guide, please let us know and we will get it added as soon

Question 2

Deployment for Login Forms

Accepted Answer

This guide walks you through how to deploy the Cymatic SDK on login pages. If there is no form on the page, please refer to the basic deployment guide. If there is a registration or password reset form, please refer to the credential defense for registration and password reset forms guide.

The point of deploying Cymatic to login form pages is to provide unrivaled visibility into how your user base interacts with these forms, enforce credential requirements, and remediate any emerging threats(various password exploits, credential stuffing, account takeover, cross site scripting attacks, etc.)

Choosing which pages of your web application to deploy Cymatic on is up to you. If you are interested in gaining visibility into the user's complete digital journey across the app, You will want to deploy Cymatic on every page. However, if you are only interested in activity on certain pages, for example a login form, then you only need to deploy Cymatic on those pages.

Once the steps outlined below are completed, you will gain insight into IP reputation, Geo events, dark web threats, bot detection, and numerous password vulnerability risks your user base is exposing your web application to.

${color}[#f15a23](Step 1: Create a new Cymatic site)

Follow the procedure outlined in the site registration guide. Perform this step only if your site has not already been created. If you have already created

Question 3

Credential Defense for Registration and Password Reset Forms

Accepted Answer

This guide covers how to deploy credential defense on registration and password reset pages. There are numerous variables to take into account for a deployment, and we will try to cover as much as possible in this guide.

Upon completion of deployment onto registration and password reset pages, you will have visibility into and/or control over the complexity requirements and different weaknesses the credentials of your user base use to access your web app. || Due to the uniqueness of each web app, it is not possible to cover every scenario in this guide. However, a best effort will be made. It is possible to leverage the Cymatic SDK to perform different actions on a registration or password reset page. One such action is to enable the submit button upon all password criteria being met and the password and confirm password field matching. How to enable the submit button in this scenario is out of scope for this guide. However, how Cymatic presents the data that can be used to make this decision will be discussed. ||| In the unlikely event that you run out of credits or the Cymatic service is not operating as expected and your web app is configured to enable the submit button on the registration and/or password reset page once the password criteria have all been met, your users may not be able to use these forms on your web app. Implementing a safeguard within your web app for this scenario is recommended. ${color}[#f15a23](Snippet deployment)

As covered in the other de

Question 4

Basic Deployment

Accepted Answer

This guide walks you through the basic Cymatic deployment procedure. The basic deployment is meant to be used on pages of your web application that do not contain forms that you want Cymatic to monitor for risks. If there is a form on the page that requires monitoring, please refer to either the credential defense for registration and password reset forms or the deployment for login forms guide.

Choosing which pages of your web application to deploy Cymatic on is up to you. If you are interested in gaining visibility into the user's complete digital journey across the app, You will want to deploy Cymatic on every page. However if you are only interested in activity on certain pages, for example a login form, then you only need to deploy Cymatic on those pages.

Once the steps outlined below are completed, you will gain insight into device information and IP reputation of what is connecting to your web app and where they are connecting from.

${color}[#f15a23](Step 1: Create a new Cymatic site)

Follow the procedure outlined in the site registration guide. Perform this step only if your site has not already been created. If you have already created a site, skip to step 2.

${color}[#f15a23](Step 2: Obtain the Cymatic SDK snippet)

Log in to the Cymatic web app. Once authenticated, from the

Question 5

Add Dark Web Lookups to Your Existing Password Policy

Accepted Answer

This guide walks through how to implement dark web lookups on a registration or password reset form that already has a built in password complexity policy in place.

If your web app is already checking for password complexity requirements, Cymatic can assist by adding dark web lookups to the checks being performed. It is possible, and quite common, for a password to password current complexity checks, however still be found on the dark web. These passwords can then be leveraged in credential stuffing attacks which can ultimately lead to an account takeover(ATO). || This guide is meant to be used as a template for deployment to an existing web application with an existing password policy in place. As with all templates, some modification may be required to fit your needs. || To complete the steps below, you will need access to modify the HTML of the web application pages you would like to deploy Cymatic on. ${color}[#f15a23](Add the snippet)

Log in to the Cymatic web app. Once authenticated, from the sites page click on the site you want to deploy protection to. Navigate to settings > installation > SDK snippet. Copy the snippet section to your clipboard. || When copying the snippet, the last line '' is not needed for this type of deployment. Please do not include this line when pasting the snippet. In the HTML code o

Question 6

Site Registration

Accepted Answer

This guide outlines the steps required to register a new site within the Cymatic application.

${color}[#f15a23](Step 1: Log in to the Cymatic app)

Log in to your Cymatic tenant. If you do not have a tenant on the Cymatic application, you can register here. Once logged in, depending on your administrative access, you will be presented with either the companies or sites dashboard. If you are on the ‘companies’ dashboard, click the appropriate company in which you would like to create the new site. Once you are on the ‘sites’ dashboard, proceed to step 2.

${color}[#f15a23](Step 2: Create the site)

Click on the ‘New Site’ button in the top right corner. In the 'Site URL' text box, enter the fully qualified URL of the site you would like to add. An example would be http://cymlink.xyz. In the 'Site Name' text box, give the site a name. This is what the site will be referred to as within the Cymatic app. Optionally, you can upload an image file to represent the site. The 'Site Restrictions' section of the form is for advanced use cases and can be left blank for the time being. When you are ready, click 'Save Changes.' At this point, the new site has been created in the Cymatic application. | Each web application with a unique fully qualified domain name(FQDN) that Cymatic protection is to be enabled on requires its own site. For example, https://example.com would be one site, and https://example1.com would be another unique

Frequently Read Articles

Browse All Categories