{"id":52993,"date":"2019-11-21T00:00:00","date_gmt":"2019-11-20T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/funktsional-sovremennyh-sistem-zashhity-prilozhenij-waf-dolzhen-byt-gorazdo-shire-spiska-uyazvimostej-iz-owasp-top-10"},"modified":"2020-02-18T14:00:49","modified_gmt":"2020-02-18T11:00:49","slug":"funktsional-sovremennyh-sistem-zashhity-prilozhenij-waf-dolzhen-byt-gorazdo-shire-spiska-uyazvimostej-iz-owasp-top-10","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/funktsional-sovremennyh-sistem-zashhity-prilozhenij-waf-dolzhen-byt-gorazdo-shire-spiska-uyazvimostej-iz-owasp-top-10","title":{"rendered":"The functionality of modern application protection systems (WAF) should be much broader than the list of vulnerabilities from the OWASP Top 10.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Retrospective<\/h4>\n

\nThe scale, composition, and structure of cyber threats to applications are rapidly evolving. For many years, users accessed web applications over the internet using popular web browsers. At any given moment, it was necessary to support 2-5 web browsers, and the set of development and testing standards for web applications was quite limited. For instance, almost all databases were built using SQL. Unfortunately, not long after, hackers learned to exploit web applications to steal, delete, or alter data. They gained unauthorized access and abused application capabilities using various techniques, including deceiving application users and injecting and executing code remotely. Soon after, commercial web application protection tools known as Web Application Firewalls (WAF) emerged in the market, and the community responded by creating an open project to secure web applications, the Open Web Application Security Project (OWASP), aimed at defining and maintaining standards and methodologies for developing secure applications.<\/a><\/noindex><\/p>\n

Basic Application Protection<\/h4>\n

\nOWASP Top 10<\/a><\/noindex> serves as a starting point for securing applications and includes a list of the most dangerous threats and misconfigurations that can lead to application vulnerabilities, as well as tactics for detecting and mitigating attacks. The OWASP Top 10 is a recognized benchmark in the global application cybersecurity industry and defines a basic list of capabilities that a web application protection system (WAF) should possess. <\/p>\n

In addition, WAF functionality should account for other common attacks on web applications, including Cross-Site Request Forgery (CSRF), Clickjacking, web scraping, and Remote File Inclusion (RFI)\/Local File Inclusion (LFI).<\/p>\n

Threats and Security Challenges of Modern Applications<\/h4>\n

\nCurrently, not all applications are executed in a networked format. There are cloud applications, mobile applications, APIs, and in the latest architectures, even individual software functions. All these types of applications need to be synchronized and controlled, as they create, modify, and process our data. With the emergence of new technologies and paradigms, new complexities and challenges arise at all stages of the application lifecycle. This includes integrating development and operations (DevOps), containers, the Internet of Things (IoT), open-source tools, APIs, and more. <\/p>\n

The distributed deployment of applications and the variety of technologies create complex and intricate tasks not only for information security specialists but also for security solution providers, who can no longer rely on a unified approach. Application protections must take into account their business specifics to prevent false positives and service quality degradation for users. <\/p>\n

The ultimate goal of hackers is usually either data theft or service disruption. Cybercriminals also gain advantages during technological evolution. First, the development of new technologies creates more potential breaches and vulnerabilities. Second, they have more tools and knowledge in their arsenal to bypass traditional protections. This significantly increases the so-called 'attack surface' and exposes organizations to new risks. Security policies must continually evolve in response to changes in technologies and applications. <\/p>\n

Thus, applications must be protected against the ever-growing variety of attack methods and sources, and the reflection of automated attacks must occur in real-time based on informed decisions. As a result, operational costs and manual labor increase amidst weakened security positions. <\/p>\n

Task No. 1: Bot Management<\/h4>\n

\nOver 60% of internet traffic is generated by bots, half of which is classified as 'bad' traffic (according to data from the Radware security report<\/a><\/noindex>). Organizations invest in increasing network bandwidth, essentially servicing fictitious loads. The precise distinction between real user traffic and bot traffic, as well as 'good' bots (such as search engine crawlers and price comparison services) and 'bad' bots, can lead to significant cost savings and improved service quality for users. <\/p>\n

Bots are not going to make this task easier, and they can mimic the behavior of real users, bypassing CAPTCHA and other obstacles. Moreover, in the case of attacks using dynamic IP addresses, IP-based filtering becomes ineffective. Often, open-source development tools (for example, Phantom JS) that can run client-side JavaScript are used to launch brute-force attacks, credential stuffing attacks, DDoS attacks, and automated bot attacks. <\/p>\n

Effective management of bot traffic requires a unique identification of its source (like a fingerprint). Since a bot attack generates numerous logs, its fingerprint can help detect suspicious activity and assign scores on which the application protection system can make informed decisions \u2013 to block\/allow \u2013 with minimal false positive rates. <\/p>\n

\"The<\/a><\/noindex><\/p>\n

Task #2: API Protection<\/h4>\n

\nMany applications collect information and data from services they interact with via APIs. When transmitting sensitive data through APIs, over 50% of organizations do not perform any verification or protection of APIs to detect cyberattacks. <\/p>\n

API Use Cases:<\/p>\n