{"id":52993,"date":"2019-11-21T00:00:00","date_gmt":"2019-11-20T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/funktsional-sovremennyh-sistem-zashhity-prilozhenij-waf-dolzhen-byt-gorazdo-shire-spiska-uyazvimostej-iz-owasp-top-10"},"modified":"2020-02-18T14:00:49","modified_gmt":"2020-02-18T11:00:49","slug":"funktsional-sovremennyh-sistem-zashhity-prilozhenij-waf-dolzhen-byt-gorazdo-shire-spiska-uyazvimostej-iz-owasp-top-10","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/funktsional-sovremennyh-sistem-zashhity-prilozhenij-waf-dolzhen-byt-gorazdo-shire-spiska-uyazvimostej-iz-owasp-top-10","title":{"rendered":"Func\u021bionalitatea sistemelor moderne de protec\u021bie a aplica\u021biilor (WAF) trebuie s\u0103 fie mult mai extins\u0103 dec\u00e2t lista de vulnerabilit\u0103\u021bi din OWASP Top 10","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<h4>Retrospectiv\u0103<\/h4>\n<p>\nScopul, compunerea \u0219i structura amenin\u021b\u0103rilor cibernetice pentru aplica\u021bii evolueaz\u0103 rapid. De-a lungul multor ani, utilizatorii s-au conectat la aplica\u021biile web prin intermediul internetului prin compararea browserelor populare. Era necesar s\u0103 se men\u021bin\u0103 2-5 browsere web \u00een orice moment, iar setul de standarde de dezvoltare \u0219i testare a aplica\u021biilor web era oarecum limitat. De exemplu, aproape toate bazele de date au fost construite folosind SQL. Din p\u0103cate, \u00eentr-un timp scurt, hackerii au \u00eenv\u0103\u021bat s\u0103 foloseasc\u0103 aplica\u021biile web pentru a fura, \u0219terge sau modifica date. Ace\u0219tia ob\u021bineau acces neautorizat \u0219i abuza de capacit\u0103\u021bile aplica\u021biilor folosind diverse tehnici, inclusiv p\u0103c\u0103lirea utilizatorilor aplica\u021biilor, inserarea \u0219i executarea codului de la distan\u021b\u0103. \u00cen scurt timp, pe pia\u021b\u0103 au ap\u0103rut solu\u021bii comerciale de protec\u021bie a aplica\u021biilor web, denumite Firewalls pentru Aplica\u021bii Web (WAF), iar societatea a reac\u021bionat prin crearea unui proiect deschis pentru securizarea aplica\u021biilor web, Open Web Application Security Project (OWASP), cu scopul de a defini \u0219i men\u021bine standardele \u0219i metodologiile pentru dezvoltarea aplica\u021biilor sigure.<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h4>Protec\u021bia de baz\u0103 a aplica\u021biilor<\/h4>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/radware.pro\/downloads\/OWASP_Top_10-2017-ru.pdf\">Lista OWASP Top 10<\/a><\/noindex> reprezint\u0103 un punct de plecare pentru asigurarea securit\u0103\u021bii aplica\u021biilor \u0219i con\u021bine un inventar al celor mai periculoase amenin\u021b\u0103ri \u0219i configur\u0103ri gre\u0219ite care pot duce la vulnerabilit\u0103\u021bi ale aplica\u021biilor, precum \u0219i tactici de detectare \u0219i respingere a atacurilor. OWASP Top 10 este un reper recunoscut \u00een industria de securitate cibernetic\u0103 a aplica\u021biilor la nivel mondial \u0219i define\u0219te o list\u0103 de capacit\u0103\u021bi de baz\u0103 pe care un sistem de protec\u021bie a aplica\u021biilor web (WAF) ar trebui s\u0103 le aib\u0103. <\/p>\n<p>\u00cen plus, func\u021bionalitatea WAF trebuie s\u0103 ia \u00een considerare alte atacuri frecvente asupra aplica\u021biilor web, inclusiv falsificarea cererilor \u00eentre site-uri (CSRF), clickjacking, web scraping \u0219i includerea de fi\u0219iere (RFI\/LFI).<\/p>\n<h4>Amenin\u021b\u0103rile \u0219i provoc\u0103rile pentru securitatea aplica\u021biilor moderne<\/h4>\n<p>\n\u00cen prezent, nu toate aplica\u021biile sunt disponibile \u00een variant\u0103 de re\u021bea. Exist\u0103 aplica\u021bii cloud, aplica\u021bii mobile, API-uri \u0219i, \u00een cele mai noi arhitecturi, chiar \u0219i func\u021bii software individuale. Toate aceste tipuri de aplica\u021bii trebuie s\u0103 fie sincronizate \u0219i controlate, deoarece ele creeaz\u0103, modific\u0103 \u0219i proceseaz\u0103 datele noastre. Odat\u0103 cu apari\u021bia noilor tehnologii \u0219i paradigme, apar noi complexit\u0103\u021bi \u0219i provoc\u0103ri \u00een toate etapele ciclului de via\u021b\u0103 al aplica\u021biilor. Aceasta include integrarea dezvolt\u0103rii \u0219i oper\u0103rii (DevOps), containere, Internetul Lucrurilor (IoT), instrumente cu surs\u0103 deschis\u0103, API-uri etc. <\/p>\n<p>Distribu\u021bia aplica\u021biilor \u0219i diversitatea tehnologiilor genereaz\u0103 sarcini complexe \u0219i complicate nu doar pentru speciali\u0219tii \u00een securitate informa\u021bional\u0103, ci \u0219i pentru produc\u0103torii de solu\u021bii de securitate, care nu se mai pot baza pe o abordare unificat\u0103. Mijloacele de protec\u021bie a aplica\u021biilor trebuie s\u0103 \u021bin\u0103 cont de specificul lor de afaceri pentru a preveni alarmele false \u0219i degradarea calit\u0103\u021bii serviciilor pentru utilizatori. <\/p>\n<p>Obiectivul final al hackerilor este, de obicei, fie furtul de date, fie afectarea disponibilit\u0103\u021bii serviciilor. Infractorii cibernetici beneficiaz\u0103, de asemenea, de evolu\u021bia tehnologic\u0103. \u00cen primul r\u00e2nd, dezvoltarea de noi tehnologii creeaz\u0103 mai multe bre\u0219e \u0219i vulnerabilit\u0103\u021bi poten\u021biale. \u00cen al doilea r\u00e2nd, au acum la dispozi\u021bie mai multe instrumente \u0219i cuno\u0219tin\u021be pentru a ocoli mijloacele tradi\u021bionale de protec\u021bie. Acest lucru cre\u0219te semnificativ a\u0219a-numita \u201esuprafa\u021b\u0103 de atac\u201d \u0219i expunerea organiza\u021biilor la noi riscuri. Politicile de securitate trebuie s\u0103 se adapteze constant la schimb\u0103rile din tehnologie \u0219i aplica\u021bii. <\/p>\n<p>Astfel, aplica\u021biile trebuie s\u0103 fie protejate \u00eempotriva variatelor metode \u0219i surse de atacuri, iar respingerea atacurilor automate ar trebui s\u0103 se fac\u0103 \u00een timp real, pe baza deciziilor informate. Ca urmare, cresc costurile opera\u021bionale \u0219i munca manual\u0103, pe fondul unor pozi\u021bii de securitate sl\u0103bite. <\/p>\n<h4>Sarcina nr. 1: Managementul botilor<\/h4>\n<p>\nMai mult de 60% din traficul pe internet este generat de bo\u021bi, dintre care jum\u0103tate se refer\u0103 la traficul \u201er\u0103u\u201d (conform datelor <noindex><a rel=\"nofollow\" href=\"https:\/\/radware.pro\/catalog\/2018-2019-radware-global-application-network-security-report\/\">raportului de securitate Radware<\/a><\/noindex>). Organiza\u021biile investesc \u00een cre\u0219terea capacit\u0103\u021bii re\u021belei, servind practic o sarcin\u0103 fictiv\u0103. Distinc\u021bia clar\u0103 \u00eentre traficul real al utilizatorilor \u0219i traficul botilor, precum \u0219i \u00eentre \u201ebotii buni\u201d (precum robo\u021bii de c\u0103utare \u0219i serviciile de comparare a pre\u021burilor) \u0219i \u201ebotii r\u0103i\u201d poate conduce la economii semnificative \u0219i \u00eembun\u0103t\u0103\u021birea calit\u0103\u021bii serviciilor pentru utilizatori. <\/p>\n<p>Boti nu inten\u021bioneaz\u0103 s\u0103 fac\u0103 aceast\u0103 sarcin\u0103 mai u\u0219oar\u0103 \u0219i pot imita comportamentul utilizatorilor reali, ocolind CAPTCHA \u0219i alte obstacole. Mai mult, \u00een cazul atacurilor cu adrese IP dinamice, protec\u021bia bazat\u0103 pe filtrarea dup\u0103 adres\u0103 IP devine ineficient\u0103. Adesea, instrumentele de dezvoltare open-source (de exemplu, Phantom JS), care pot executa JavaScript-ul clientului, sunt utilizate pentru a efectua atacuri brute-force, atacuri de tip credential stuffing, atacuri DDoS \u0219i atacuri automate ale botilor. <\/p>\n<p>Pentru gestionarea eficient\u0103 a traficului botilor este necesar\u0103 o identificare unic\u0103 a sursei acestuia (asem\u0103n\u0103toare cu un amprente digitale). Deoarece \u00een cazul unui atac cu boti exist\u0103 numeroase \u00eenregistr\u0103ri, amprenta acestuia permite identificarea activit\u0103\u021bii suspecte \u0219i atribuirea de scoruri, pe baza c\u0103rora sistemul de protec\u021bie a aplica\u021biilor ia o decizie informat\u0103 \u2013 de a bloca\/permite \u2013 cu un procent minim de rezultate fals pozitive. <\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/radware.pro\/catalog\/2018-2019-radware-global-application-network-security-report\/\"><img decoding=\"async\" alt=\"Func\u021bionalitatea sistemelor moderne de protec\u021bie a aplica\u021biilor (WAF) trebuie s\u0103 fie mult mai extins\u0103 dec\u00e2t lista de vulnerabilit\u0103\u021bi din OWASP Top 10\" src=\"\/wp-content\/uploads\/2019\/11\/54764c31a86863be4e6f4ed16ff4b65c.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h4>Obiectivul nr. 2: Protec\u021bia API<\/h4>\n<p>\nMulte aplica\u021bii colecteaz\u0103 informa\u021bii \u0219i date de la serviciile cu care interac\u021bioneaz\u0103 prin API. \u00cen cazul transmisiei de date sensibile prin API, peste 50% din organiza\u021bii nu efectueaz\u0103 nicio verificare sau protec\u021bie a API-urilor pentru a identifica atacurile cibernetice. <\/p>\n<p>Exemple de utilizare a API-ului:<\/p>\n<ul>\n<li>Integrarea Internetului Lucrurilor (IoT)<\/li>\n<li>Interac\u021biunea \u00eentre ma\u0219ini<\/li>\n<li>Mediile serverless <\/li>\n<li>Aplica\u021biile mobile<\/li>\n<li>Aplica\u021biile bazate pe evenimente<\/li>\n<\/ul>\n<p>\nVulnerabilit\u0103\u021bile API sunt asem\u0103n\u0103toare cu vulnerabilit\u0103\u021bile aplica\u021biilor \u0219i includ inject\u0103ri, atacuri la protocoale, manipularea parametrilor, redirec\u021bion\u0103ri \u0219i atacuri cu bot-uri. Gateway-urile API dedicate permit garantarea compatibilit\u0103\u021bii serviciilor aplica\u021biilor care interac\u021bioneaz\u0103 prin API. Cu toate acestea, ele nu ofer\u0103 o securitate holistic\u0103 a aplica\u021biilor, a\u0219a cum poate asigura un WAF cu instrumentele de securitate necesare, precum analiza capetelor HTTP, lista de control al accesului Layer 7 (ACL), analiza \u0219i verificarea \u00eenc\u0103rc\u0103turii utile JSON\/XML, precum \u0219i protejarea de toate vulnerabilit\u0103\u021bile din lista OWASP Top 10. Acest lucru se realizeaz\u0103 prin inspectarea valorilor cheie ale API utiliz\u00e2nd modele pozitive \u0219i negative. <\/p>\n<h4>Sarcina nr. 3: Refuz \u00een furnizare<\/h4>\n<p>\nVechea vector de atac \u2014 refuzul \u00een furnizare (DoS) \u2014 continu\u0103 s\u0103-\u0219i dovedeasc\u0103 eficien\u021ba \u00een atacurile asupra aplica\u021biilor. Atacatorii dispun de un \u00eentreg arsenal de tehnici de succes pentru a perturba func\u021bionarea serviciilor aplica\u021biilor, inclusiv inunda\u021bii HTTP sau HTTPS, atacuri cu putere sc\u0103zut\u0103 \u0219i lente ('low-and-slow', de exemplu, SlowLoris, LOIC, Torshammer), atacuri utiliz\u00e2nd adrese IP dinamice, suprasarcin\u0103 a buffer-ului, atacuri brute-force \u0219i multe altele. Odat\u0103 cu dezvoltarea Internetului lucrurilor \u0219i apari\u021bia ulterioar\u0103 a botnet-urilor IoT, atacurile asupra aplica\u021biilor au devenit principala direc\u021bie a atacurilor DDoS. Majoritatea WAF-urilor cu urm\u0103rirea st\u0103rii conexiunilor pot face fa\u021b\u0103 doar unui volum limitat de sarcin\u0103. Cu toate acestea, ele pot inspecta fluxurile de trafic HTTP\/S \u0219i elimina traficul de atacuri \u0219i conexiunile d\u0103un\u0103toare. Dup\u0103 identificarea unei atac, nu are sens s\u0103 se permit\u0103 din nou acest trafic. Deoarece l\u0103\u021bimea de band\u0103 a WAF-ului pentru respingerea atacurilor este limitat\u0103, este necesar\u0103 o solu\u021bie suplimentar\u0103 pe perimetrul re\u021belei pentru a bloca automat urm\u0103toarele \u201epachete rele\u201d. Pentru acest scenariu de protec\u021bie, ambele solu\u021bii ar trebui s\u0103 aib\u0103 capacitatea de a interac\u021biona \u00eentre ele pentru a schimba informa\u021bii despre atacuri. <\/p>\n<p><img decoding=\"async\" alt=\"Func\u021bionalitatea sistemelor moderne de protec\u021bie a aplica\u021biilor (WAF) trebuie s\u0103 fie mult mai extins\u0103 dec\u00e2t lista de vulnerabilit\u0103\u021bi din OWASP Top 10\" src=\"\/wp-content\/uploads\/2019\/11\/0891b6ac8b043b813a831fc8bede5122.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Fig 1. Organizarea unei protec\u021bii complexe a re\u021belei \u0219i aplica\u021biilor exemplificat\u0103 prin solu\u021biile Radware<\/i><\/p>\n<h4>Sarcina nr. 4: Protec\u021bie continu\u0103<\/h4>\n<p>\nAplica\u021biile sunt adesea supuse modific\u0103rilor. Metodologiile de dezvoltare \u0219i implementare, cum ar fi continuitatea actualiz\u0103rilor, \u00eenseamn\u0103 c\u0103 modific\u0103rile se fac f\u0103r\u0103 interven\u021bie \u0219i control uman. \u00cen astfel de condi\u021bii dinamice, este dificil s\u0103 men\u021bii politici de securitate eficiente f\u0103r\u0103 un num\u0103r ridicat de alarme false. Aplica\u021biile mobile se actualizeaz\u0103 mult mai frecvent dec\u00e2t cele web. Aplica\u021biile dezvoltatorilor ter\u021bi pot suferi schimb\u0103ri f\u0103r\u0103 cuno\u0219tin\u021ba ta. Unele organiza\u021bii caut\u0103 s\u0103 ob\u021bin\u0103 un control \u0219i o vizibilitate mai mare pentru a r\u0103m\u00e2ne la curent cu riscurile poten\u021biale. Cu toate acestea, acest lucru nu este \u00eentotdeauna realizabil, iar o protec\u021bie eficient\u0103 a aplica\u021biilor trebuie s\u0103 foloseasc\u0103 capacit\u0103\u021bile \u00eenv\u0103\u021b\u0103rii automate pentru a lua \u00een considerare \u0219i a vizualiza resursele existente, analiz\u00e2nd amenin\u021b\u0103rile poten\u021biale, cre\u00e2nd \u0219i optimiz\u00e2nd politicile de securitate \u00een cazul modific\u0103rii aplica\u021biilor.<\/p>\n<h4>Conclusions<\/h4>\n<p>\nPe m\u0103sur\u0103 ce aplica\u021biile joac\u0103 un rol din ce \u00een ce mai important \u00een via\u021ba de zi cu zi, ele devin o \u021bint\u0103 principal\u0103 pentru hackeri. Cump\u0103rarea poten\u021bial\u0103 pentru infractori \u0219i pierderile poten\u021biale pentru afaceri sunt uria\u0219e. Complexitatea asigur\u0103rii securit\u0103\u021bii aplica\u021biilor nu poate fi subestimat\u0103, av\u00e2nd \u00een vedere num\u0103rul \u0219i varia\u021biile aplica\u021biilor \u0219i amenin\u021b\u0103rilor. <\/p>\n<p>Din fericire, ne afl\u0103m \u00eentr-un moment \u00een care inteligen\u021ba artificial\u0103 poate veni \u00een ajutorul nostru. Algoritmii bazati pe \u00eenv\u0103\u021barea automat\u0103 ofer\u0103 protec\u021bie adaptiv\u0103 \u00een timp real \u00eempotriva celor mai avansate amenin\u021b\u0103ri cibernetice direc\u021bionate c\u0103tre aplica\u021bii. De asemenea, ace\u0219tia actualizeaz\u0103 automat politicile de securitate pentru a proteja aplica\u021biile web, mobile \u0219i cloud \u2014 precum \u0219i API-urile \u2014 f\u0103r\u0103 alarme false.<\/p>\n<p>Este greu s\u0103 prezici cu exactitate cum va ar\u0103ta noua genera\u021bie de amenin\u021b\u0103ri cibernetice pentru aplica\u021bii (posibil \u0219i bazat\u0103 pe \u00eenv\u0103\u021barea automat\u0103). Cu toate acestea, organiza\u021biile pot lua m\u0103suri pentru a proteja datele clien\u021bilor, proprietatea intelectual\u0103 \u0219i pentru a asigura disponibilitatea serviciilor cu un mare beneficiu pentru afaceri.<\/p>\n<p>Metode eficiente \u0219i metode de asigurare a securit\u0103\u021bii aplica\u021biilor, principalele tipuri \u0219i vectori de atac, zonele de risc \u0219i lacunele \u00een ap\u0103rarea cibernetic\u0103 a aplica\u021biilor web, precum \u0219i experien\u021ba global\u0103 \u0219i cele mai bune practici sunt prezentate \u00een studiul \u0219i raportul Radware.<noindex><a rel=\"nofollow\" href=\"https:\/\/radware.pro\/catalog\/web_application_security_digitally_connected_world_2019\/\">Securitatea Aplica\u021biilor Web \u00eentr-o Lume Digital Conectat\u0103<\/a><\/noindex>\u201d.<br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/476490\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0420\u0435\u0442\u0440\u043e\u0441\u043f\u0435\u043a\u0442\u0438\u0432\u0430 \u041c\u0430\u0441\u0448\u0442\u0430\u0431, \u0441\u043e\u0441\u0442\u0430\u0432 \u0438 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430 \u043a\u0438\u0431\u0435\u0440\u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0431\u044b\u0441\u0442\u0440\u043e \u044d\u0432\u043e\u043b\u044e\u0446\u0438\u043e\u043d\u0438\u0440\u0443\u044e\u0442. \u0414\u043e\u043b\u0433\u0438\u0435 \u0433\u043e\u0434\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c \u0447\u0435\u0440\u0435\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u0435\u0431-\u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432. \u0412 \u043a\u0430\u0436\u0434\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0431\u044b\u043b\u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c 2-5 \u0432\u0435\u0431-\u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432, \u0438 \u043d\u0430\u0431\u043e\u0440 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0431\u044b\u043b \u0432 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u043e\u0447\u0442\u0438 \u0432\u0441\u0435 \u0431\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445 \u0431\u044b\u043b\u0438 \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u044b \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c SQL. \u041a [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-52993","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0420\u0435\u0442\u0440\u043e\u0441\u043f\u0435\u043a\u0442\u0438\u0432\u0430 \u041c\u0430\u0441\u0448\u0442\u0430\u0431, \u0441\u043e\u0441\u0442\u0430\u0432 \u0438 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430 \u043a\u0438\u0431\u0435\u0440\u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0431\u044b\u0441\u0442\u0440\u043e \u044d\u0432\u043e\u043b\u044e\u0446\u0438\u043e\u043d\u0438\u0440\u0443\u044e\u0442. \u0414\u043e\u043b\u0433\u0438\u0435 \u0433\u043e\u0434\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c \u0447\u0435\u0440\u0435\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u0435\u0431-\u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/funktsional-sovremennyh-sistem-zashhity-prilozhenij-waf-dolzhen-byt-gorazdo-shire-spiska-uyazvimostej-iz-owasp-top-10\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0424\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 (WAF) \u0434\u043e\u043b\u0436\u0435\u043d \u0431\u044b\u0442\u044c \u0433\u043e\u0440\u0430\u0437\u0434\u043e \u0448\u0438\u0440\u0435 \u0441\u043f\u0438\u0441\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438\u0437 OWASP \u0422\u043e\u043f 10 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0420\u0435\u0442\u0440\u043e\u0441\u043f\u0435\u043a\u0442\u0438\u0432\u0430 \u041c\u0430\u0441\u0448\u0442\u0430\u0431, \u0441\u043e\u0441\u0442\u0430\u0432 \u0438 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430 \u043a\u0438\u0431\u0435\u0440\u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0431\u044b\u0441\u0442\u0440\u043e \u044d\u0432\u043e\u043b\u044e\u0446\u0438\u043e\u043d\u0438\u0440\u0443\u044e\u0442. \u0414\u043e\u043b\u0433\u0438\u0435 \u0433\u043e\u0434\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c \u0447\u0435\u0440\u0435\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u0435\u0431-\u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/funktsional-sovremennyh-sistem-zashhity-prilozhenij-waf-dolzhen-byt-gorazdo-shire-spiska-uyazvimostej-iz-owasp-top-10\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-11-20T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:00:49+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Func\u021bionalitatea sistemelor moderne de protec\u021bie a aplica\u021biilor (WAF) trebuie s\u0103 fie mult mai extins\u0103 dec\u00e2t lista vulnerabilit\u0103\u021bilor din OWASP Top 10 | ProHoster","description":"Retrospectiv\u0103 Scopul, compozi\u021bia \u0219i structura amenin\u021b\u0103rilor cibernetice pentru aplica\u021bii evolueaz\u0103 rapid. Mul\u021bi ani, utilizatorii au avut acces la aplica\u021biile web prin internet folosind browsere web populare.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/funktsional-sovremennyh-sistem-zashhity-prilozhenij-waf-dolzhen-byt-gorazdo-shire-spiska-uyazvimostej-iz-owasp-top-10","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0424\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 (WAF) \u0434\u043e\u043b\u0436\u0435\u043d \u0431\u044b\u0442\u044c \u0433\u043e\u0440\u0430\u0437\u0434\u043e \u0448\u0438\u0440\u0435 \u0441\u043f\u0438\u0441\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438\u0437 OWASP \u0422\u043e\u043f 10 | ProHoster","og:description":"\u0420\u0435\u0442\u0440\u043e\u0441\u043f\u0435\u043a\u0442\u0438\u0432\u0430 \u041c\u0430\u0441\u0448\u0442\u0430\u0431, \u0441\u043e\u0441\u0442\u0430\u0432 \u0438 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430 \u043a\u0438\u0431\u0435\u0440\u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0431\u044b\u0441\u0442\u0440\u043e \u044d\u0432\u043e\u043b\u044e\u0446\u0438\u043e\u043d\u0438\u0440\u0443\u044e\u0442. \u0414\u043e\u043b\u0433\u0438\u0435 \u0433\u043e\u0434\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c \u0447\u0435\u0440\u0435\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u0435\u0431-\u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/funktsional-sovremennyh-sistem-zashhity-prilozhenij-waf-dolzhen-byt-gorazdo-shire-spiska-uyazvimostej-iz-owasp-top-10","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-20T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52993","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 05:40:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:33:28","updated":"2026-01-24 05:40:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/52993","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=52993"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/52993\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=52993"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=52993"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=52993"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}