{"id":55733,"date":"2020-01-27T00:00:00","date_gmt":"2020-01-26T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/evolyutsiya-web-application-firewall-ot-setevyh-ekranov-do-oblachnyh-sistem-zashhity-s-mashinnym-obucheniem"},"modified":"2020-02-18T14:03:52","modified_gmt":"2020-02-18T11:03:52","slug":"evolyutsiya-web-application-firewall-ot-setevyh-ekranov-do-oblachnyh-sistem-zashhity-s-mashinnym-obucheniem","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/evolyutsiya-web-application-firewall-ot-setevyh-ekranov-do-oblachnyh-sistem-zashhity-s-mashinnym-obucheniem","title":{"rendered":"Evolucioni i Web Application Firewall: nga mur\u00ebt mbrojt\u00ebs te sistemet mbrojt\u00ebse n\u00eb cloud me m\u00ebsim automatik","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb materialin ton\u00eb t\u00eb kaluar mbi tem\u00ebn e cloud-it ne treguam<\/a><\/noindex>, si t\u00eb mbrohet infrastruktura IT n\u00eb cloud publik dhe pse antivirus\u00ebt tradicional\u00eb nuk jan\u00eb krejt\u00ebsisht t\u00eb p\u00ebrshtatsh\u00ebm p\u00ebr k\u00ebto q\u00ebllime. N\u00eb k\u00ebt\u00eb postim do t\u00eb vazhdojm\u00eb tem\u00ebn e siguris\u00eb n\u00eb cloud dhe do t\u00eb flasim p\u00ebr evoluimin e WAF dhe se \u00e7far\u00eb \u00ebsht\u00eb m\u00eb mir\u00eb t\u00eb zgjidhni: harduer, softuer ose cloud.\u00a0<\/b><\/p>\n

\"Evolucioni
\n<\/p>\n

\u00c7far\u00eb \u00ebsht\u00eb WAF<\/h3>\n

\nM\u00eb shum\u00eb se 75% e sulmeve nga hakera jan\u00eb t\u00eb drejtuara ndaj dob\u00ebsive t\u00eb aplikacioneve web dhe faqeve: k\u00ebto sulme zakonisht jan\u00eb t\u00eb padukshme p\u00ebr infrastruktur\u00ebn dhe sh\u00ebrbimet e siguris\u00eb. Dob\u00ebsit\u00eb e aplikacioneve web p\u00ebrmbajn\u00eb, nga ana e tyre, rreziqe t\u00eb kompromentimit dhe mashtrimit t\u00eb llogarive dhe t\u00eb dh\u00ebnave personale t\u00eb p\u00ebrdoruesve, fjal\u00ebkalimeve, numrave t\u00eb kartave t\u00eb kreditit. P\u00ebr m\u00eb tep\u00ebr, dob\u00ebsit\u00eb n\u00eb nj\u00eb faqe interneti sh\u00ebrbejn\u00eb si pik\u00eb hyrjeje p\u00ebr sulmuesit n\u00eb rrjetin korporativ.<\/p>\n

Web Application Firewall (WAF) paraqet nj\u00eb ekran mbrojt\u00ebs, i cili bllokon sulmet ndaj aplikacioneve web: SQL injeksione, skriptim t\u00eb nd\u00ebrfaqes s\u00eb p\u00ebrdoruesit, ekzekutimin e kodit n\u00eb distanc\u00eb, brute force dhe shmangien e autorizimit (auth bypass). Kjo p\u00ebrfshin edhe sulmet q\u00eb p\u00ebrdorin dob\u00ebsi zero-day. Firewall-\u00ebt e aplikacioneve sigurojn\u00eb mbrojtje duke monitoruar p\u00ebrmbajtjen e faqeve web, duke p\u00ebrfshir\u00eb HTML, DHTML dhe CSS, dhe duke filtruar k\u00ebrkesat potencialisht d\u00ebmtuese p\u00ebrmes HTTP\/HTTPS.
\n<\/a><\/noindex><\/p>\n

Cilat ishin zgjidhjet e para?<\/h3>\n

\nP\u00ebrpjekjet e para p\u00ebr t\u00eb krijuar Web Application Firewall u b\u00ebn\u00eb q\u00eb n\u00eb fillim t\u00eb viteve '90. Dihet t\u00eb pakt\u00ebn p\u00ebr tre inxhinier\u00eb q\u00eb punuan n\u00eb k\u00ebt\u00eb fush\u00eb. I pari \u2014 profesori i shkencave kompjuterike Jean Spafford nga Universiteti Purdue. Ai p\u00ebrshkroi arkitektur\u00ebn e nj\u00eb firewall-i aplikacionesh me proxy dhe e publikoi at\u00eb n\u00eb 1991 n\u00eb librin \u201eSiguria UNIX n\u00eb praktik\u00eb\u201c<\/a><\/noindex>.<\/p>\n

I dyti dhe i treti \u2014 ishin specialist\u00ebt e siguris\u00eb William Cheswick dhe Marcus Ranum nga Bell Labs. Ata zhvilluan nj\u00eb nga prototipet e para t\u00eb firewall-\u00ebve t\u00eb aplikacioneve. Shp\u00ebrndarja e tij u realizua nga kompania DEC \u2014 produkti u l\u00ebshua me emrin SEAL (Secure External Access Link). <\/p>\n

Por SEAL nuk ishte nj\u00eb zgjidhje e plot\u00eb WAF. Ai p\u00ebrb\u00ebnte nj\u00eb firewall t\u00eb zakonsh\u00ebm t\u00eb rrjetit me funksionalitet t\u00eb zgjeruar \u2014 mund\u00ebsin\u00eb p\u00ebr t\u00eb bllokuar sulmet ndaj FTP dhe RSH. P\u00ebr k\u00ebt\u00eb arsye, sot zgjidhja e par\u00eb WAF konsiderohet produkti i kompanis\u00eb Perfecto Technologies (m\u00eb pas Sanctum). N\u00eb vitin 1999 ajo ka prezantuar<\/a><\/noindex> sistemin AppShield. N\u00eb at\u00eb koh\u00eb, Perfecto Technologies po merreshin me zhvillimin e zgjidhjeve t\u00eb siguris\u00eb p\u00ebr e-commerce dhe audienca q\u00eb kishin synuar p\u00ebr produktin e tyre t\u00eb ri ishin dyqanet online. AppShield kishte aft\u00ebsin\u00eb t\u00eb analizonte k\u00ebrkesat HTTP dhe bllokonte sulmet n\u00eb baz\u00eb t\u00eb politikave dinamike t\u00eb siguris\u00eb.<\/p>\n

Rreth t\u00eb nj\u00ebjt\u00ebs koh\u00eb me AppShield (n\u00eb vitin 2002) u shfaq WAF-i i par\u00eb me kod t\u00eb hapur. Ai quhej ModSecurity<\/a><\/noindex>. Ai u krijua me q\u00ebllim q\u00eb t\u00eb popullarizonte teknologjit\u00eb WAF dhe mb\u00ebshtetet ende nga komuniteti IT (ja repoja e tij n\u00eb GitHub<\/a><\/noindex>). ModSecurity bllokon sulmet ndaj aplikacioneve duke u bazuar n\u00eb nj\u00eb grup standard t\u00eb shprehjeve t\u00eb rregullta (n\u00ebnshkrimeve) \u2014 mjete p\u00ebr kontrollin e k\u00ebrkesave sipas nj\u00eb modeli \u2014 Seti Kryesor i Rregullave t\u00eb OWASP<\/a><\/noindex>.<\/p>\n

Si rezultat, zhvilluesit arrit\u00ebn ta realizonin q\u00ebllimin e tyre \u2014 n\u00eb treg filluan t\u00eb shfaqen zgjidhje t\u00eb reja WAF, p\u00ebrfshir\u00eb ato t\u00eb nd\u00ebrtuara mbi ModSecurity.<\/p>\n

T\u00eb treja gjeneratat \u2014 tashm\u00eb histori<\/h3>\n

\nPraket e zakonshme jan\u00eb identifikimi i tre gjeneratave t\u00eb sistemeve WAF, t\u00eb cilat kan\u00eb evoluar me zhvillimin e teknologjive.<\/p>\n

Gjenerata e par\u00eb<\/b>. Puna me shprehje t\u00eb rregullta (ose gramatika). Nd\u00ebr t\u00eb tjera \u00ebsht\u00eb ModSecurity. Ofruesi i sistemit studion llojet e sulmeve ndaj aplikacioneve dhe formon modele q\u00eb p\u00ebrshkruajn\u00eb k\u00ebrkesa legjitime dhe potencialisht t\u00eb d\u00ebmshme. WAF-i p\u00ebrputhet me k\u00ebto listat dhe vendos se \u00e7far\u00eb t\u00eb b\u00ebj\u00eb n\u00eb situata t\u00eb caktuara \u2014 t\u00eb bllokoj\u00eb trafik apo jo.<\/p>\n

Nj\u00eb shembull i zbulimit n\u00eb baz\u00eb t\u00eb shprehjeve t\u00eb rregullta \u00ebsht\u00eb projekti q\u00eb u p\u00ebrmend m\u00eb par\u00eb Seti Kryesor i Rregullave<\/a><\/noindex> me kod t\u00eb hapur. Nj\u00eb shembull tjet\u00ebr \u00ebsht\u00eb Naxsi<\/a><\/noindex>, i cili gjithashtu \u00ebsht\u00eb me kod t\u00eb hapur. Sistemet me shprehje t\u00eb rregullta kan\u00eb disa disavantazhe, ve\u00e7an\u00ebrisht, kur zbulohet nj\u00eb dob\u00ebsi e re, administratori duhet t\u00eb krijoj\u00eb rregulla shtes\u00eb manualisht. N\u00eb rastin e nj\u00eb infrastrukture t\u00eb madhe IT, rregullat mund t\u00eb jen\u00eb mij\u00ebra. T\u00eb menaxhosh nj\u00eb num\u00ebr kaq t\u00eb madh shprehjesh t\u00eb rregullta \u00ebsht\u00eb mjaft e v\u00ebshtir\u00eb, p\u00ebrve\u00e7 faktit se kontrolli i tyre mund t\u00eb ul\u00eb performanc\u00ebn e rrjetit.<\/p>\n

Po gjithashtu, shprehjet e rregullta kan\u00eb nj\u00eb nivel t\u00eb lart\u00eb t\u00eb rremeve pozitive. Ling\u00fcisti i njohur Noam Chomsky ofroi nj\u00eb klasifikim t\u00eb gramatikave, duke i ndar\u00eb ato n\u00eb kat\u00ebr nivele t\u00eb kushtuesh\u00ebm kompleksiteti. Sipas k\u00ebsaj klasifikimi, me shprehje t\u00eb rregullta mund t\u00eb p\u00ebrshkruhen vet\u00ebm rregullat e firewall-it q\u00eb nuk parashikojn\u00eb devijime nga modeli. Kjo do t\u00eb thot\u00eb se ata q\u00eb kryejn\u00eb sulme mund t\u00eb 'mashtrojn\u00eb' leht\u00ebsisht WAF-in e gjenerat\u00ebs s\u00eb par\u00eb. Nj\u00eb nga metodat p\u00ebr ta luftuar k\u00ebt\u00eb \u00ebsht\u00eb t\u00eb shtohen n\u00eb k\u00ebrkesat p\u00ebr aplikacione simbole speciale q\u00eb nuk ndikojn\u00eb n\u00eb logjik\u00ebn e t\u00eb dh\u00ebnave t\u00eb d\u00ebmshme, por p\u00ebrshtatin rregullin e n\u00ebnshkrimit.<\/p>\n

\"Evolucioni
\n
\nGjenerata e dyt\u00eb<\/b>. P\u00ebr t\u00eb anashkaluar problemet q\u00eb lidhen me performanc\u00ebn dhe sakt\u00ebsin\u00eb e WAF-it, jan\u00eb zhvilluar firewall-a t\u00eb aplikacioneve t\u00eb gjenerat\u00ebs s\u00eb dyt\u00eb. Aty jan\u00eb shfaqur parser\u00eb q\u00eb jan\u00eb p\u00ebrgjegj\u00ebs p\u00ebr identifikimin e tipeve strikte t\u00eb sulmeve (n\u00eb HTML, JS etj.). K\u00ebta parser\u00eb punojn\u00eb me token\u00eb t\u00eb ve\u00e7ant\u00eb q\u00eb p\u00ebrshkruajn\u00eb k\u00ebrkesat (p.sh., variable, string, unknown, number). Sekuencat potencialisht t\u00eb d\u00ebmshme t\u00eb token\u00ebve nxirren n\u00eb nj\u00eb list\u00eb t\u00eb ve\u00e7ant\u00eb, me t\u00eb cil\u00ebn WAF-i kontrollohet rregullisht. Ky qasje u tregua p\u00ebr her\u00eb t\u00eb par\u00eb n\u00eb konferenc\u00ebn Black Hat 2012 n\u00eb form\u00ebn e bibliotek\u00ebs C\/C++\u00a0libinjection<\/a><\/noindex>, e cila lejon identifikimin e injeksioneve SQL.<\/p>\n

N\u00eb krahasim me WAF-in e gjenerat\u00ebs s\u00eb par\u00eb, parser\u00ebt e specializuar mund t\u00eb punojn\u00eb m\u00eb shpejt. Megjithat\u00eb, ata nuk zgjidhin v\u00ebshtir\u00ebsit\u00eb q\u00eb lidhen me konfigurimin manual t\u00eb sistemit kur shfaqen sulme t\u00eb reja t\u00eb d\u00ebmshme. <\/p>\n

\"Evolucioni
\n
\nGjenerata e tret\u00eb<\/b>. Evolucioni n\u00eb logjik\u00ebn e zbulimit t\u00eb gjenerat\u00ebs s\u00eb tret\u00eb q\u00ebndron n\u00eb p\u00ebrdorimin e metodave t\u00eb m\u00ebsimit t\u00eb makinerive, q\u00eb ofron mund\u00ebsin\u00eb m\u00eb t\u00eb af\u00ebrt p\u00ebr gramatik\u00ebn e zbulimit me gramatik\u00ebn reale SQL\/HTML\/JS t\u00eb sistemeve t\u00eb mbrojtura. Kjo logjik\u00eb zbulimi \u00ebsht\u00eb n\u00eb gjendje t\u00eb adaptohet me makin\u00ebn Turing p\u00ebr t\u00eb mbuluar gramatikat q\u00eb num\u00ebrohen rekurzivisht. M\u00eb par\u00eb, detyra e krijimit t\u00eb nj\u00eb makine Turing t\u00eb adaptueshme ka qen\u00eb e pazgjidhshme, derisa jan\u00eb publikuar hulumtimet e para mbi makinat neuronale Turing.<\/p>\n

M\u00ebsimi i makinave ofron nj\u00eb mund\u00ebsi unike p\u00ebr t\u00eb p\u00ebrshtatur \u00e7do gramatik\u00eb p\u00ebr t\u00eb mbuluar \u00e7do lloj sulmi pa krijuar manualisht lista n\u00ebnshkrimesh, si\u00e7 k\u00ebrkohej n\u00eb zbulimin e brezit t\u00eb par\u00eb, dhe pa zhvilluar tokenizues \/ parser\u00eb t\u00eb rinj p\u00ebr lloje t\u00eb reja sulmesh si Memcached, Redis, Cassandra, SSRF, ashtu si\u00e7 k\u00ebrkonte metodologjia e brezit t\u00eb dyt\u00eb. <\/p>\n

Duke bashkuar t\u00eb tre brezat e logjik\u00ebs s\u00eb zbulimit, ne mund t\u00eb vizatojm\u00eb nj\u00eb diagram t\u00eb ri, ku brezi i tret\u00eb i zbulimit \u00ebsht\u00eb i paraqitur me nj\u00eb vij\u00eb t\u00eb kuqe (shih. 3). N\u00eb k\u00ebt\u00eb brez p\u00ebrfshihet nj\u00eb nga zgjidhjet q\u00eb ne implementojm\u00eb n\u00eb mjete cloud n\u00eb bashk\u00ebpunim me 'Onsec', zhvilluesin e platform\u00ebs p\u00ebr mbrojtjen adaptuese t\u00eb aplikacioneve web dhe API-s\u00eb Valarm. <\/p>\n

Tani, logjika e zbulimit p\u00ebrdor feedback nga aplikacioni p\u00ebr vet\u00eb-rregullim. N\u00eb kuad\u00ebr t\u00eb m\u00ebsimit t\u00eb makinave, ky cik\u00ebl feedback quhet 'forcim'. N\u00eb p\u00ebrgjith\u00ebsi, ekzistojn\u00eb nj\u00eb ose m\u00eb shum\u00eb lloje t\u00eb k\u00ebtij forcmimi:<\/p>\n