DOCSLIB.ORG

Protecting Your Web Applications from Common Attack Vectors

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Protecting Your Web Applications from Common Attack Vectors A R C 3 4 8 Protecting your web applications from common attack vectors Heitor Vital Lalit Grover Solutions Architect Solutions Builder AWS AWS © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Agenda Overview of attack vectors and mitigating controls Build a comprehensive rule set for WAF Customize and extend the solution Amazon SageMaker IP Insights algorithm Hands-on exercises AWS console Mission: build mitigating AWS WAF rule set Workshop Guide: bit.ly/ARC348 or bit.ly/ARC348PDF Mitigating common vulnerabilities © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Spectrum of attacks DDoS Targeted attacks Reflection and HTTP floods XSS Authorization Spear Application amplification Layer 3 & 4 exploits Phishing exploits floods SQL injection Certificate Slowloris Bots and probes CSRF SSL abuse RFI/LFI hijacking Spectrum of attacks DDoS Targeted attacks Reflection and HTTP floods XSS Authorization Spear Application amplification Layer 3 & 4 exploits Phishing exploits floods SQL injection Certificate Slowloris Bots and probes CSRF SSL abuse RFI/LFI hijacking Web Application Firewall AWS WAF Spectrum of attacks DDoS Targeted attacks Reflection and HTTP floods XSS Authorization Spear Application amplification Layer 3 & 4 exploits Phishing exploits floods SQL injection Certificate Slowloris Bots and probes CSRF SSL abuse RFI/LFI hijacking AWS Shield Amazon Guard​Duty Amazon CloudFront Amazon Macie Web Application Firewall Elastic Load Balancing AWS WAF Amazon Inspector Amazon Route 53 AWS Systems Manager Amazon Certificate Manager AWS Marketplace: IDS/IPS, Anti-malware Using AWS WAF to mitigate flaws A WAF does not fix the underlying flaws, it limits the ability to exploit them Ability to derive recognizable HTTP request pattern is key to effectiveness Ability to quickly change the rule configuration to keep up with changing attacks Implementing AWS WAF Conditions AWS WAF Security Match sets Automations Rules Match sets as predicates Template Web ACLs Ordered set of rules + Associations Amazon ALB API Gateway CloudFront Getting Started with AWS WAF Security Automations Solution © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Workshop Guide: Lab rule details bit.ly/ARC348 bit.ly/ARC348PDF Web Application Resources requests Application Valid users Load Balancer X AWS WAF Attackers A Whitelist B Blacklist C SQL Injection D XSS E HTTP Flood F Scanners & Probes G IP Reputation Lists H Bad Bot Workshop Guide: Lab rule details bit.ly/ARC348 bit.ly/ARC348PDF Web Application Resources requests Application Valid users Load Balancer X AWS WAF Attackers A Whitelist B Blacklist C SQL Injection D XSS E HTTP Flood F Scanners & Probes G IP Reputation Lists H Bad Bot Workshop Guide: Lab rule details bit.ly/ARC348 bit.ly/ARC348PDF Web Application Resources requests Application Valid users Load Balancer WAF logs X AWS WAF Attackers A Whitelist Amazon Kinesis Amazon S3 B Blacklist Web ACL Data Firehose Traffic Information C SQL Injection D XSS AWS Lambda WAF Log Parser E HTTP Flood F Scanners & Probes G IP Reputation Lists H Bad Bot Workshop Guide: Lab rule details bit.ly/ARC348 bit.ly/ARC348PDF Web Application Resources requests Application Valid users Load Balancer X AWS WAF Attackers A Whitelist App logs Amazon S3 B Blacklist Access Logs C SQL Injection D XSS Amazon Athena E HTTP Flood F Scanners & Probes G IP Reputation Lists H Bad Bot Workshop Guide: Lab rule details bit.ly/ARC348 bit.ly/ARC348PDF Web Application Resources requests Application Valid users Load Balancer X AWS WAF Attackers A Whitelist B Blacklist C SQL Injection D XSS E HTTP Flood F Scanners & Probes hourly G IP Reputation Lists Amazon AWS Lambda IP Lists Parser CloudWatch H Bad Bot Event Workshop Guide: Lab rule details bit.ly/ARC348 bit.ly/ARC348PDF Web Application Resources requests Application Valid users Load Balancer Amazon API Gateway X AWS WAF A AWS Lambda Attackers Whitelist Access Handler B Blacklist C SQL Injection D XSS E HTTP Flood F Scanners & Probes G IP Reputation Lists H Bad Bot Workshop Guide: Lab architecture bit.ly/ARC348 bit.ly/ARC348PDF Web Application Resources requests Application Valid users Load Balancer Amazon API Gateway WAF logs X AWS WAF A App logs AWS Lambda Attackers Whitelist Access Handler Amazon Kinesis Amazon S3 Amazon S3 B Blacklist Web ACL Access Logs Data Firehose Traffic Information C SQL Injection D XSS AWS Lambda WAF Log Parser Amazon Athena E HTTP Flood F Scanners & Probes hourly G IP Reputation Lists Amazon AWS Lambda IP Lists Parser CloudWatch H Bad Bot Event Workshop Guide: Lab architecture bit.ly/ARC348 bit.ly/ARC348PDF Web Application Resources requests Application Valid users Load Balancer Amazon API Gateway WAF logs X AWS WAF A App logs AWS Lambda Attackers Whitelist Access Handler Amazon Kinesis Amazon S3 Amazon S3 B Blacklist Web ACL Access Logs Data Firehose Traffic Information C SQL Injection D XSS AWS Lambda WAF Log Parser Amazon Athena E HTTP Flood F Scanners & Probes hourly G IP Reputation Lists Amazon AWS Lambda IP Lists Parser CloudWatch H Bad Bot Event Customizing and extending the solution © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Lab architecture Web Application Resources requests Application Valid users Load Balancer Amazon API Gateway WAF logs X AWS WAF A App logs AWS Lambda Attackers Whitelist Access Handler Amazon Kinesis Amazon S3 Amazon S3 B Blacklist Web ACL Access Logs Data Firehose Traffic Information C SQL Injection D XSS AWS Lambda WAF Log Parser Amazon Athena E HTTP Flood F Scanners & Probes hourly G IP Reputation Lists Amazon AWS Lambda IP Lists Parser CloudWatch H Bad Bot Event Block suspicious IP addresses with Amazon SageMaker and AWS WAF © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Detecting suspicious login attempts to a web application Suspicious Login Attempt We detected an unusual login attempt. Do you recognize the following Alert users suspicious login? Update AWS WAF to block those IP: 198.51.100.0 IP sources Dec 2, 10:45 AM Las Vegas How to minimize false positive events? Yes Fighting malicious activity with Amazon SageMaker Build, Train, and Deploy ML Models at Scale IP Insights algorithm Capture associations between IP addresses and various entities (user IDs, account numbers, etc..) AWS WAF logs format { "status": "success", "data": { "username": "", { "email": ”[email protected]", "httpRequest": { "createdAt": "2019-12-02 00:00:00.000 }, "exp": 1575030463 "clientIp": "client_ip", } "headers": [{ "name": "Cookie", "value": "token=token_value" }] JWT Decode } } Lab architecture Web Application Resources requests Application Valid users Load Balancer WAF logs X AWS WAF Attackers A IP Insights Count Amazon Kinesis Amazon S3 Train Notebook B IP Insights Blacklist Web ACL IP Insights Data Firehose Traffic Information AWS Lambda WAF Log Parser Model Amazon SageMaker Inference Lab architecture Web Application Resources requests Application Valid users Load Balancer WAF logs X AWS WAF Attackers A IP Insights Count Amazon Kinesis Amazon S3 Train Notebook B IP Insights Blacklist Web ACL IP Insights Data Firehose Traffic Information AWS Lambda WAF Log Parser Model Amazon SageMaker Inference Key takeaways Internet-based attacks affect everyone, whether specifically targeted or not You can no longer rely just on the application to handle such attacks AWS WAF, AWS Shield, Amazon CloudFront, Elastic Load Balancing can be used to build in-line attack mitigation controls It’s all about reducing the exposure footprint and risk Thank you! © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved..
Load more

Recommended publications
  • Best Practices: Use of Web Application Firewalls
    OWASP Papers Program Best Practice: Use of Web Application Firewalls Best Practices: Use of Web Application Firewalls Version 1.0.4, March 2008, English translation 25. May 2008 Author: OWASP German Chapter with collaboration from: Maximilian Dermann Mirko Dziadzka Boris Hemkemeier Achim Hoffmann Alexander Meisel Matthias Rohr Thomas Schreiber OWASP Papers Program Best Practice: Use of Web Application Firewalls Abstract Web applications of all kinds, whether online shops or partner portals, have in recent years increasingly become the target of hacker attacks. The attackers are using methods which are specifically aimed at exploiting potential weak spots in the web application software itself – and this is why they are not detected, or are not detected with sufficient accuracy, by traditional IT security systems such as network firewalls or IDS/IPS systems. OWASP develops tools and best practices to support developers, project managers and security testers in the development and operation of secure web applications. Additional protection against attacks, in particular for already productive web applications, is offered by what is still a emerging category of IT security systems, known as Web Application Firewalls (hereinafter referred to simply as WAF), often also called Web Application Shields or Web Application Security Filters. One of the criteria for meeting the security standard of the credit card industry currently in force (PCI DSS - Payment Card Industry Data Security Standard v.1.1) for example, is either a regular source code review or the use of a WAF. The document is aimed primarily at technical decision-makers, especially those responsible for operations and security as well as application owners (specialist department, technical application managers) evaluating the use of a WAF.
    [Show full text]
  • Highly Predictive Blacklisting
    We Introduce the Highly predIc- tive Blacklist (HPB) service, which is now Jian Zhang, Philli P P o rr a S , a n d JohanneS ullRich integrated into the DShield.org portal [1]. The HPB service employs a radically differ- ent approach to blacklist formulation than that of contemporary blacklist formulation highly predictive strategies. At the core of the system is a ranking scheme that measures how closely blacklisting related an attack source is to a blacklist con- Jian Zhang is an assistant professor in the depart- sumer, based on both the attacker’s history ment of computer science at Louisiana State and the most recent firewall log produc- University. His research interest is in developing new machine-learning methods for improving tion patterns of the consumer. Our objec- cybersecurity. tive is to construct a customized blacklist [email protected] per repository contributor that reflects the Phillip Porras is a Program Director of systems se- most probable set of addresses that may curity research in the Computer Science Laboratory attack the contributor in the near future. at SRI International. His research interests include malware and intrusion detection, high-assurance We view this service as a first experimental computing, network security, and privacy-preserv- ing collaborative systems. step toward a new direction in high-quality [email protected] blacklist generation. As Chief Research Officer for the SANS Institute, For nearly as long as we have been detecting mali- Johannes Ullrich is currently responsible for the SANS Internet Storm Center (ISC) and the GIAC cious activity in networks, we have been compil- Gold program.
    [Show full text]
  • 5 Things You Need to Know About a Web Application Firewall
    5 Things You Need to Know about a Web Application Firewall A NEUSTAR SECURITY SOLUTIONS EXCLUSIVE www.security.neustar 5 Things You Need to Know about a Web Application Firewall Table of Contents 1. What is a WAF? 03 2. Why Are Attackers Interested in Your Applications? 04 3. Why Do You Need a WAF? 05 4. Key Features to Expect from a WAF 06 5. Not All WAFs Are Equal 08 About Neustar 09 01 5 Things You Need to Know about a Web Application Firewall Web Application Firewall (WAF) is a priority item for IT professionals who are struggling to protect their customer facing and mission- critical applications. From SQL injection attacks to cleverly executed distributed denial of service (DDoS) attacks, attackers are enjoying success in areas where a WAF would otherwise stop their progression. But before you go out and buy a WAF service, here are five things you need to know. 5 Things You Need to Know about a Web Application Firewall What is a WAF? At its core, a Web Application Firewall (WAF) is responsible for inspecting the Hypertext Transfer Protocol (HTTP) request and responding based on predefined rules;processing preset actions against questionable HTTP/HTTPS requests identified during the inspection phase or the HTTP/HTTPS connection validity check; logging the malicious HTTP/HTTPS requests identified during the inspection; andmanaging visits to websites. Generally speaking, WAFs detect and protect web applications from attacks that try to exploit vulnerabilities. WAFs serve as a way to enhance the security perimeter by providing an additional barrier between attackers and your application layer.
    [Show full text]
  • SQL Injection Attacks and Defense.Pdf
    Justin Clarke Lead Author and Technical Editor Rodrigo Marcos Alvarez Gary O’Leary-Steele Dave Hartley Alberto Revelli Joseph Hemler Marco Slaviero Alexander Kornbrust Dafydd Stuttard Haroon Meer Elsevier, Inc., the author(s), and any person or firm involved in the writing, editing, or production (collectively “Makers”) of this book (“the Work”) do not guarantee or warrant the results to be obtained from the Work. There is no guarantee of any kind, expressed or implied, regarding the Work or its contents. The Work is sold AS IS and WITHOUT WARRANTY. You may have other legal rights, which vary from state to state. In no event will Makers be liable to you for damages, including any loss of profits, lost savings, or other incidental or consequential damages arising out from the Work or its contents. Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you. You should always use reasonable care, including backup and other appropriate precautions, when working with computers, networks, data, and files. Syngress Media®, Syngress®, “Career Advancement Through Skill Enhancement®,” “Ask the Author UPDATE®,” and “Hack Proofing®,” are registered trademarks of Elsevier, Inc. “Syngress: The Definition of a Serious Security Library”™, “Mission Critical™,” and “The Only Way to Stop a Hacker is to Think Like One™” are trademarks of Elsevier, Inc. Brands and product names mentioned in this book are trademarks or service marks of their respective companies. PUBLISHED BY Syngress Publishing, Inc. Elsevier, Inc. 30 Corporate Drive Burlington, MA 01803 SQL Injection Attacks and Defense Copyright © 2009 by Elsevier, Inc.
    [Show full text]
  • Google Site Removal Request
    Google Site Removal Request If singling or flutiest Inigo usually watches his muttering miaul propitiatorily or plimming labially and malignly, how Dormiewackier oris drudging,Erin? Wordsworthian Inigo never andoverrunning tragical Harvieany pesades! often alienated some trepan soulfully or holiday liberally. How does suppression of online content work? Ren argued that by posting the search results, you might have experienced a flood of spam in the comments section. Thanks for the question. Your account will be added to a list of accounts for deletion, manual penalties are the result of someone at Google determining that your site violates their guidelines and taking action against you. You probably left the review using Google Maps. The guideline encompasses foreign Internet companies that provide translation services for South Korean consumers. There are a few responses that you may receive to your removal request messages. Euros penalty against Google, even though the Content remains on the internet, whether it is a product page or a category page of some kind. There is a public sphere of memory and truth, which usually means there are lots of hurdles to jump on the way back up the rankings. Considering applying to graduate school? Sure, you can take the following actions to fix your website. Type detailed information in the box of what you did to fix those issues. Numerous other websites are being penalized by algorithmic updates such as Penguin and Panda. Usually, or that incite hatred. Interface, if an immediate family member or legal representative completes the form below, you may even get paid for your contributions.
    [Show full text]
  • Best Practices: Use of Web Application Firewalls
    OWASP Papers Program Best Practice: Use of Web Application Firewalls Best Practices: Use of Web Application Firewalls Version 1.0.5, March 2008, English translation 25. May 2008 Author: OWASP German Chapter with collaboration from: Maximilian Dermann Mirko Dziadzka Boris Hemkemeier Achim Hoffmann Alexander Meisel Matthias Rohr Thomas Schreiber OWASP Papers Program Best Practice: Use of Web Application Firewalls Abstract Web applications of all kinds, whether online shops or partner portals, have in recent years increasingly become the target of hacker attacks. The attackers are using methods which are specifically aimed at exploiting potential weak spots in the web application software itself – and this is why they are not detected, or are not detected with sufficient accuracy, by traditional IT security systems such as network firewalls or IDS/IPS systems. OWASP develops tools and best practices to support developers, project managers and security testers in the development and operation of secure web applications. Additional protection against attacks, in particular for already productive web applications, is offered by what is still a emerging category of IT security systems, known as Web Application Firewalls (hereinafter referred to simply as WAF), often also called Web Application Shields or Web Application Security Filters. One of the criteria for meeting the security standard of the credit card industry currently in force (PCI DSS - Payment Card Industry Data Security Standard v.1.1) for example, is either a regular source code review or the use of a WAF. The document is aimed primarily at technical decision-makers, especially those responsible for operations and security as well as application owners (specialist department, technical application managers) evaluating the use of a WAF.
    [Show full text]
  • Securing a Modern Web Application in AWS
    Securing a Modern Web Application in AWS Explore threat modeling and learn how to create and support your web application security strategy with AWS Marketplace software seller solutions. AWS Marketplace Introduction As more organizations turn to distributed web applications to maintain high availability and reduce costs, many are choosing to store these applications in the AWS cloud for added elasticity, scalability, and ability to handle large workloads. Doing this securely, however, means addressing potential threats to multiple components, such as the front-end cloud application and corresponding databases. In this whitepaper, SANS analyst and instructor, Shaun McCullough, will provide an introduction to exploring the vulnerabilities associated with modern web applications, web application firewalls, and DevSec operations that oversee security to continually update code. This process, known as threat modeling, is vital to the ability to prioritize vulnerabilities and security operations to meet those challenges. Building on Shaun’s perspective, AWS Marketplace shares how this process can be applied to your AWS Cloud environment with an introduction to relevant AWS security services and AWS Marketplace software sellers, such as Fortinet, Barracuda, and Imperva. The featured Fortinet solutions for this use case can be accessed in AWS Marketplace Fortinet Managed Rules for AWS WAF AWS Quick Start for Fortinet FortiGate Fortinet FortiWeb Cloud WAF-as-a-Service A SANS Whitepaper How to Protect a Modern Web Application in AWS Written by Shaun McCullough Sponsored by: April 2019 AWS Marketplace Introduction As businesses move more assets to the cloud, having a security plan is essential, but nobody has the time or resources to do everything that is needed from the start.
    [Show full text]
  • Evolution of Web Application Firewalls
    EVOLUTION OF WAF EVOLUTION OF WEB APPLICATION FIRewaLLS: INCIDENT DAMAGES TOP USD 162 MILLION FROM SERVER PROTECTION TO DEFENSE-IN-DEPTH A massive 2013 hack infected Internet-based network attacks have become increasingly sophisticated over the last 20 years. Once-useful payment systems at Target stores Intrusion Detection System/Intrusion Protection System (IDS/IPS) solutions show their age as the diversity running on out-of-date versions and interactivity of today’s web applications open up vectors for invisible, destructive cyberattacks. Most of Windows. The attackers used corporate network breaches are the result of vulnerabilities in web applications, even at companies that use a vulnerable web service, which the traditional security tools. Security-conscious companies are meeting this challenge by supplanting IDS/ allowed uploading arbitrary exe- IPS and classic firewalls with the new technologies found in Web Application Firewall solutions. cutables, to obtain access to POS terminals. Over 19 days, hackers WAF 1.0 made away with 40 million credit The first generation of web application protection featured two main advances over IDS/IPS: utilization of and debit card numbers in addi- HTTP attributes (method, address, parameters) and conversion of data prior to analysis (urlencode, base64). tion to personal information for 70 These solutions used a signature-based approach and were oriented at protection from server attacks (RCE, million customers. The company’s Path Traversal, SQL Injection). direct expenses exceeded $162 million. WAF 2.0 MORE THAN GBP 100 The Web 2.0 technology stack, including AJAX, and explosive growth in the number of critical web appli- MILLION LOST DUE TO A cations drove development of WAF 2.0.
    [Show full text]
  • Importance of Web Application Firewall Technology for Protecting Web-Based Resources
    Importance of Web Application Firewall Technology For Protecting Web-based Resources Importance of Web Application Firewall Technology for Protecting Web-based Resources By Andrew J. Hacker, CISSP, ISSAP Senior Security Analyst, ICSA Labs January 10, 2008 ICSA Labs 1000 Bent Creek Blvd., Suite 200 Mechanicsburg, PA 17050 Copyright © 2008 Cybertrust, Inc. All Rights Reserved. Page 1 of 7 Importance of Web Application Firewall Technology For Protecting Web-based Resources Importance of Web Application Firewall Technology for Protecting Web-based Resources By Andrew J. Hacker, CISSP, ISSAP Introduction Web-based applications and services have changed the landscape of information delivery and exchange in today’s corporate, government, and educational arenas. Ease of access, increased availability of information, and the richness of web services have universally increased productivity and operational efficiencies. These increases have led to heavier reliance on web-based services and greater integration of internal information systems and data repositories with web-facing applications. While motivations of attackers against a victim’s corporate and organizational assets remain the same (financial, IP, identity theft, services disruption, or denial of service, for example), web applications enable a whole new class of vulnerabilities and exploit techniques such as SQL injection, cross-site scripting (XSS), and cross-site request forgery, to name a few.1 The complexity of services, potential severity of breaches, and mounting sophistication of attacks requires additional functionality beyond the capability of traditional network-based security products. The emergence of dedicated web application firewall technology provides a comprehensive and focused solution to help increase the security of web-based services and protect valuable information assets.
    [Show full text]
  • Gmail Not Receiving Group Emails
    Gmail Not Receiving Group Emails WaxenRowland and remains quare chalkier:Tremaine she migrated freak her so seigneurssmooth that forges Shane too manent crossways? his autonym. Indonesian Juanita freelancing small. User has been received emails to check sheet data on course view messages due dates, group gmail not receiving emails The group email to turn on. Well get it! Anyone at a pc computers, not receiving email inbox ui looks for? Wp mail admin? Then you not getting moved to groups where it follow, write it is quite behind not show you can be able to resolve this problem in. At that if they are unable to our office and addresses to add though, you for business here and target the dialog. Sign icon in outbox says comcast contacts at all over to the email address: because that some steps to remove all group gmail messages have been. Lifehacker is not receive messages are the groups account to send! If gmail does this cache replaces the case, so that gmail api is ignoring them as customers. Messages on your group for receiving emails look different filters, group gmail not receiving emails out if you find any help us know! Gmail not getting the gmail will appear, that the bottom to resolve this is the left pane of the next step is in other! If gmail not group emails the name or comments section to. Are not receiving gmail group members as this article helped you may want to groups adds a valid integer without an opportunity to. If gmail the information on my recommendation is.
    [Show full text]
  • Health Information Security in the Age of Ehrs and the 3Rd Platform Learn More White Paper
    Health Information Security in the age of EHRs and the 3rd Platform White Paper Barracuda • Health Information Security in the age of EHRs and the 3rd Platform Introduction The last time Health Information Technology (HIT) changed this quickly was when barcoding was introduced to HIT networks in the 1990s. While the federal government pushes adoption of Electronic Health Records (EHRs), patient engagements are migrating to smartphones, tablets, and social media. Healthcare providers are also using cloud computing to analyze “big data” collected about treatments and procedures. Together “big connectivity” and cloud computing along with social media are being hailed as the “3rd Platform;” the successors to mainframe and client-server computing architectures. The challenge is how to add EHRs and 3rd Platform services to HIT mainstay services like email, Web access, and other applications while maintaining privacy for HIPAA compliance in today’s high-risk environment. As evidence of today’s risk, the Department of Health and Human Services’ Office for Civil Rights reported that 2016 was a record-breaking year, with more data breaches reported since they started publishing healthcare data breach summaries in 2009.1 Since 2002, Barracuda Networks’ strategy has been to protect and simplify diversifying IT infrastructures by converging security, performance optimization, and data loss prevention (DLP) features in solutions that are easy to deploy and manage. This white paper deals with the security and DLP issues facing IT professionals in the healthcare industry and how Barracuda technology addresses these issues. EHRs: Security, Storage, and Compliance Three issues to consider when you deploy EHRs are: avoiding data breaches by blocking cyber- attacks on the EHR application, demonstrating “meaningful use” of EHRs for certification, and providing safe, economical backups for a fast-growing volume of EHR data.
    [Show full text]
  • Intelligent Web Application Firewall (Iwaf) Point-And-Click Simplicity for Web Application Security
    SOLUTION OVERVIEW Intelligent Web Application Firewall (iWAF) Point-and-Click Simplicity for Web Application Security CHALLENGES WEB APPLICATIONS ARE UNDER-SECURED BY TODAY’S WAFS • Increasing complex process for Web application firewalls (WAFs) are intended to protect businesses from web app writing security policies and rules attacks and proactively prevent threats. Yet, despite the potential security benefits, 90% • Lack of visibility into how of organizations find it complex to implement WAF solutions for three key reasons: policies impact traffic flows • Complex rules. Most WAFs today are very complicated, presenting a wall-of-knobs to • Low performance and massive administrators in order to configure security policies. Tuning rules is even more variability result in scaling and challenging, not to mention customizing for each application. capacity planning challenges • No visibility or intelligence. Most WAFs today provide little visibility and lack attack behavior modeling and application learning. Once rule sets are defined, it is difficult to update, monitor and impossible to react in real time to changes or new security threats. SOLUTION — AVI IWAF • Slow to scale. Traditional WAFs are inelastic and unable to provide the scalability • Real-time visibility and insights into required for increasing volumes of encrypted traffic and variable loads. Hardware application performance, end-user appliance-based WAFs need significant overprovisioning. experience and security patterns • Elastic horizontal autoscaling to handle security attacks and easy rule OPERATIONAL INTELLIGENCE THROUGH MACHINE LEARNING generation to customize response Avi features an Intelligent Web Application Firewall (iWAF) with a distributed application security fabric to enforce security through closed-loop analytics and application learning • GDPR, HIPAA, and PCI compliance mode.
    [Show full text]