{"id":55733,"date":"2020-01-27T00:00:00","date_gmt":"2020-01-26T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/evolyutsiya-web-application-firewall-ot-setevyh-ekranov-do-oblachnyh-sistem-zashhity-s-mashinnym-obucheniem"},"modified":"2020-02-18T14:03:52","modified_gmt":"2020-02-18T11:03:52","slug":"evolyutsiya-web-application-firewall-ot-setevyh-ekranov-do-oblachnyh-sistem-zashhity-s-mashinnym-obucheniem","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/evolyutsiya-web-application-firewall-ot-setevyh-ekranov-do-oblachnyh-sistem-zashhity-s-mashinnym-obucheniem","title":{"rendered":"Evolucioni i Web Application Firewall: nga ekranet e rrjetit n\u00eb sistemet mbrojt\u00ebs t\u00eb cloud me t\u00eb m\u00ebsuarit e makineris\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb materialin ton\u00eb t\u00eb kaluar mbi tem\u00ebn e \u043e\u0431\u043b\u0430\u043a\u0430, ne fol\u00ebm<\/a><\/noindex>, si t\u00eb mbrohet IT burimet n\u00eb \u043e\u0431\u043b\u0430\u043a\u0435 publike dhe pse antivirus\u00ebt tradicional\u00eb nuk jan\u00eb gjithmon\u00eb t\u00eb p\u00ebrshtatsh\u00ebm p\u00ebr k\u00ebto q\u00ebllime. N\u00eb k\u00ebt\u00eb post, ne do t\u00eb vazhdojm\u00eb tem\u00ebn e siguris\u00eb s\u00eb \u043e\u0431\u043b\u0430\u043a\u0430 dhe do t\u00eb flasim p\u00ebr evolucionin e WAF dhe se \u00e7far\u00eb \u00ebsht\u00eb m\u00eb mir\u00eb t\u00eb zgjidhet: hardware, software apo \u043e\u0431\u043b\u0430\u043a\u0435.\u00a0<\/b><\/p>\n

\"Evolucioni
\n<\/p>\n

\u00c7far\u00eb \u00ebsht\u00eb WAF<\/h3>\n

\nM\u00eb shum\u00eb se 75% t\u00eb sulmeve nga hakerat jan\u00eb t\u00eb drejtuara ndaj dob\u00ebsive t\u00eb aplikacioneve web dhe faqeve: k\u00ebto sulme zakonisht jan\u00eb t\u00eb padukshme p\u00ebr infrastruktur\u00ebn dhe sh\u00ebrbimet e siguris\u00eb IT. Dob\u00ebsit\u00eb e aplikacioneve web sjellin me vete rrezik t\u00eb komprometimit dhe mashtrimit t\u00eb llogarive dhe t\u00eb dh\u00ebnave personale t\u00eb p\u00ebrdoruesve, fjal\u00ebkalimeve, numrave t\u00eb kartave t\u00eb kreditit. P\u00ebr m\u00eb tep\u00ebr, dob\u00ebsit\u00eb n\u00eb faqen e internetit sh\u00ebrbejn\u00eb si nj\u00eb pik\u00eb hyr\u00ebse p\u00ebr kriminel\u00ebt n\u00eb rrjetin korporativ.<\/p>\n

Web Application Firewall (WAF) \u00ebsht\u00eb nj\u00eb ekran mbrojt\u00ebs q\u00eb bllokon sulmet ndaj aplikacioneve web: injeksione SQL, skriptim t\u00eb nd\u00ebrmjet\u00ebm, ekzekutimin e kodit n\u00eb distanc\u00eb, bruteforce dhe anashkalimin e autorizimit. P\u00ebrfshin gjithashtu sulme q\u00eb p\u00ebrdorin dob\u00ebsi zero-day. Firewall-et e aplikacioneve ofrojn\u00eb mbrojtje duke monitoruar p\u00ebrmbajtjen e faqeve web, duke p\u00ebrfshir\u00eb HTML, DHTML dhe CSS, dhe duke filtruar k\u00ebrkesat potencialisht t\u00eb d\u00ebmshme p\u00ebrmes HTTP\/HTTPS.
\n<\/a><\/noindex><\/p>\n

Cilat ishin zgjidhjet e para?<\/h3>\n

\nP\u00ebrpjekjet e para p\u00ebr t\u00eb krijuar nj\u00eb Web Application Firewall u nd\u00ebrmor\u00ebn q\u00eb n\u00eb fillim t\u00eb viteve '90. Dihet p\u00ebr t\u00eb pakt\u00ebn tre inxhinier\u00eb q\u00eb punuan n\u00eb k\u00ebt\u00eb fush\u00eb. I pari ishte profesori i shkencave kompjuterike Gene Spafford nga Universiteti i Purdue. Ai p\u00ebrshkroi arkitektur\u00ebn e firewall-it t\u00eb aplikacioneve me proksi dhe n\u00eb vitin 1991 e publikoi at\u00eb n\u00eb librin e tij \u00abSiguria e UNIX n\u00eb praktik\u00eb\u00bb<\/a><\/noindex>.<\/p>\n

I dyti dhe i treti ishin specialist\u00ebt e siguris\u00eb IT William Cheswick dhe Marcus Ranum nga Bell Labs. Ata zhvilluan nj\u00eb nga prototipat e par\u00eb t\u00eb firewall-eve t\u00eb aplikacioneve. P\u00ebr shp\u00ebrndarjen e tij, kompania DEC punoi n\u00ebn emrin SEAL (Secure External Access Link). <\/p>\n

Por SEAL nuk ishte nj\u00eb zgjidhje e plot\u00eb WAF. Ai p\u00ebrb\u00ebnte nj\u00eb firewall klasik rrjeti me funksionalitet t\u00eb zgjeruar \u2014 duke bllokuar sulmet ndaj FTP dhe RSH. P\u00ebr k\u00ebt\u00eb arsye, zgjidhja e par\u00eb WAF sot konsiderohet produkti i kompanis\u00eb Perfecto Technologies (m\u00eb von\u00eb Sanctum). N\u00eb vitin 1999 ajo paraqiti<\/a><\/noindex> sistemi AppShield. N\u00eb at\u00eb koh\u00eb, Perfecto Technologies po zhvillonin zgjidhje IT p\u00ebr e-commerce, dhe audienca e synuar e produktit t\u00eb tyre t\u00eb ri ishin dyqanet online. AppShield mund t\u00eb analizonte k\u00ebrkesat HTTP dhe bllokonte sulmet bazuar n\u00eb politikat e dinamike t\u00eb siguris\u00eb IT.<\/p>\n

Af\u00ebrsisht n\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb me AppShield (n\u00eb vitin 2002) u shfaq WAF-i i par\u00eb me burim t\u00eb hapur. Ai u b\u00eb ModSecurity<\/a><\/noindex>. Ai u krijua me q\u00ebllim popularizimin e teknologjive WAF dhe mb\u00ebshtetet nga komuniteti IT deri tani (k\u00ebtu \u00ebsht\u00eb repo n\u00eb GitHub<\/a><\/noindex>). ModSecurity bllokon sulmet ndaj aplikacioneve duke u bazuar n\u00eb nj\u00eb grup standard t\u00eb shenjave (n\u00ebnshkrimeve) \u2014 mjeteve p\u00ebr kontrollimin e k\u00ebrkesave sipas modelit \u2014 OWASP Core Rule Set<\/a><\/noindex>.<\/p>\n

Si rezultat, zhvilluesit arrit\u00ebn q\u00ebllimin e tyre \u2014 n\u00eb treg filluan t\u00eb shfaqen zgjidhje t\u00eb reja WAF, duke p\u00ebrfshir\u00eb ato t\u00eb nd\u00ebrtuara mbi baz\u00ebn e ModSecurity.<\/p>\n

Tre gjenerata \u2014 tashm\u00eb histori<\/h3>\n

\nPranohet se ekzistojn\u00eb tre gjenerata t\u00eb sistemeve WAF, q\u00eb jan\u00eb evoluar me zhvillimin e teknologjive.<\/p>\n

Gjenerata e par\u00eb<\/b>. Punon me shenja regulatore (ose gramatika). Ajo p\u00ebrfshin ModSecurity. Ofruesi i sistemit studion llojet e sulmeve ndaj aplikacioneve dhe formon modele q\u00eb p\u00ebrshkruajn\u00eb k\u00ebrkesat legjitime dhe t\u00eb mundshme t\u00eb d\u00ebmshme. WAF krahason k\u00ebto lista dhe vendos se \u00e7far\u00eb t\u00eb b\u00ebj\u00eb n\u00eb situat\u00ebn konkrete \u2014 t\u00eb bllokoj\u00eb trafikun apo jo.<\/p>\n

Nj\u00eb shembull i zbulimit n\u00eb baz\u00eb t\u00eb shenjave \u00ebsht\u00eb projekti i p\u00ebrmendur tashm\u00eb Core Rule Set<\/a><\/noindex> me burim t\u00eb hapur. Nj\u00eb shembull tjet\u00ebr \u00ebsht\u00eb Naxsi<\/a><\/noindex>, i cili gjithashtu \u00ebsht\u00eb me burim t\u00eb hapur. Sistemet me shenja regulatore kan\u00eb disa disavantazhe, sidomos kur b\u00ebhet fjal\u00eb p\u00ebr zbulimin e nj\u00eb dob\u00ebsie t\u00eb re, administratorit i duhet t\u00eb krijoj\u00eb rregulla shtes\u00eb manualisht. N\u00eb rastin e nj\u00eb infrastrukture IT t\u00eb madhe, mund t\u00eb ket\u00eb disa mij\u00ebra rregulla. Menaxhimi i k\u00ebtij numri t\u00eb madh t\u00eb shenjave \u00ebsht\u00eb mjaft i komplikuar, p\u00ebr t\u00eb mos p\u00ebrmendur se verifikimi i tyre mund t\u00eb ul\u00eb performanc\u00ebn e rrjetit.<\/p>\n

Gjithashtu, shenjat regulatore kan\u00eb nj\u00eb nivel t\u00eb lart\u00eb t\u00eb rreziqeve t\u00eb rreme. Linguisti i njohur Noam Chomsky propozoi nj\u00eb klasifikim t\u00eb gramatikave, n\u00eb t\u00eb cilin i ndau ato n\u00eb kat\u00ebr nivele t\u00eb kushtueshme kompleksiteti. Sipas k\u00ebtij klasifikimi, shenjat regulatore mund t\u00eb p\u00ebrshkruajn\u00eb vet\u00ebm rregullat e firewall-it q\u00eb nuk parashikojn\u00eb devijime nga modeli. Kjo do t\u00eb thot\u00eb se kriminel\u00ebt mund t\u00eb \"mashtrojn\u00eb\" leht\u00ebsisht WAF-in e gjenerat\u00ebs s\u00eb par\u00eb. Nj\u00eb nga metodat p\u00ebr t\u00eb luftuar k\u00ebt\u00eb \u00ebsht\u00eb t\u00eb shtoni simbole speciale n\u00eb k\u00ebrkesat ndaj aplikacioneve, t\u00eb cilat nuk ndikojn\u00eb n\u00eb logjik\u00ebn e t\u00eb dh\u00ebnave t\u00eb d\u00ebmshme, por prishin rregullin e n\u00ebnshkrimit.<\/p>\n

\"Evolucioni
\n
\nGjeni i dyt\u00eb<\/b>. P\u00ebr t\u00eb zgjidhur problematikat e performanc\u00ebs dhe sakt\u00ebsis\u00eb t\u00eb WAF, u zhvilluan firewalls t\u00eb aplikacioneve t\u00eb gjenerat\u00ebs s\u00eb dyt\u00eb. Aty u introdukohen parser\u00eb q\u00eb identifikojn\u00eb lloje t\u00eb caktuar sulmesh (p\u00ebr HTML, JS etj.). K\u00ebta parser\u00eb punojn\u00eb me tokensa t\u00eb ve\u00e7ant\u00eb q\u00eb p\u00ebrshkruajn\u00eb k\u00ebrkesat (p.sh., variable, string, unknown, number). Sekuencat potencialisht t\u00eb d\u00ebmshme t\u00eb token\u00ebve p\u00ebrfshihen n\u00eb nj\u00eb list\u00eb t\u00eb ve\u00e7ant\u00eb, me t\u00eb cil\u00ebn sistemi WAF raportohet rregullisht. P\u00ebr her\u00eb t\u00eb par\u00eb ky qasje u prezantua n\u00eb konferenc\u00ebn Black Hat 2012 n\u00eb form\u00ebn e C\/C++\u00a0bibliotek\u00ebs libinjection<\/a><\/noindex>, e cila lejon identifikimin e SQL injection.<\/p>\n

N\u00eb krahasim me WAF t\u00eb gjenerat\u00ebs s\u00eb par\u00eb, parser\u00ebt e specializuar mund t\u00eb punojn\u00eb m\u00eb shpejt. Megjithat\u00eb, ata nuk e zgjidh\u00ebn v\u00ebshtir\u00ebsin\u00eb e konfigurimit manual t\u00eb sistemit n\u00eb rastin e sulmeve t\u00eb reja t\u00eb d\u00ebmshme. <\/p>\n

\"Evolucioni
\n
\nGjeni i tret\u00eb<\/b>. Evolucioni n\u00eb logjik\u00ebn e identifikimit t\u00eb gjenerat\u00ebs s\u00eb tret\u00eb q\u00ebndron n\u00eb p\u00ebrdorimin e metodave t\u00eb m\u00ebsimit t\u00eb makineris\u00eb, duke afruar sa m\u00eb pran\u00eb gramatik\u00ebs s\u00eb identifikimit me gramatik\u00ebn reale t\u00eb SQL\/HTML\/JS q\u00eb mbrohen nga sistemet. Kjo logjik\u00eb identifikimi \u00ebsht\u00eb n\u00eb gjendje t\u00eb adaptoj\u00eb makin\u00ebn e Turingut p\u00ebr t\u00eb p\u00ebrfshir\u00eb gramatikat e enumeruara rekurzive. Nd\u00ebrkoh\u00eb, deri m\u00eb tani detyra e krijimit t\u00eb nj\u00eb makine Turingu t\u00eb adaptueshme ishte e pazgjidhshme, derisa u publikuan hulumtimet e para mbi makinat neurale t\u00eb Turingut.<\/p>\n

M\u00ebsimi i makineris\u00eb ofron nj\u00eb mund\u00ebsi unike p\u00ebr t\u00eb adaptuar \u00e7do gramatik\u00eb p\u00ebr t\u00eb mbuluar \u00e7do lloj sulmesh pa krijuar listat e n\u00ebnshkrimeve manualisht, si\u00e7 k\u00ebrkohej p\u00ebr identifikimin e gjenerat\u00ebs s\u00eb par\u00eb, dhe pa zhvillimin e tokenizer\u00ebve\/parser\u00ebve t\u00eb rinj p\u00ebr lloje t\u00eb reja sulmesh, si Memcached injections, Redis, Cassandra, SSRF, sikurse k\u00ebrkonte metodologjia e gjenerat\u00ebs s\u00eb dyt\u00eb. <\/p>\n

Duke bashkuar t\u00eb tre gjeneratat e logjik\u00ebs s\u00eb identifikimit, ne mund t\u00eb p\u00ebrshkruajm\u00eb nj\u00eb diagram t\u00eb ri, ku gjenerata e tret\u00eb e identifikimit p\u00ebrfaq\u00ebsohet me nj\u00eb kontur t\u00eb kuq (shih figur\u00ebn 3). Kjo gjenerat\u00eb p\u00ebrfshin nj\u00eb nga zgjidhjet q\u00eb ne e implementojm\u00eb n\u00eb re n\u00eb bashk\u00ebpunim me \"Onsec\", zhvilluesin e platform\u00ebs s\u00eb mbrojtjes adaptuese t\u00eb aplikacioneve web dhe API-s\u00eb Valarm. <\/p>\n

Tani logjika e identifikimit p\u00ebrdor reagimin nga aplikacioni p\u00ebr auto-konfigurim. N\u00eb kuad\u00ebr t\u00eb m\u00ebsimit t\u00eb makineris\u00eb, ky cik\u00ebl reagimi quhet \"forcim\". N\u00eb p\u00ebrgjith\u00ebsi, ka nj\u00eb ose m\u00eb shum\u00eb lloje t\u00eb till\u00eb forcimi:<\/p>\n