Imperva waf
•Download as PPTX, PDF•
3 likes•1,879 views
Презентация продукта Web Application Firewall (WAF) от одного из "пионеров" и нынешнего лидера* отрасли (*по версии квадранта Gartner для WAF от 2014 года) Russian presentation of WAF solution from the leader of the market (*according to Gartner MG from 2014).
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Imperva waf
Similar to Imperva waf (20)
Imperva waf
- 1. Решения Imperva WAF для защиты критически-важных бизнес-приложений. Обзор основных угроз для Web Шахлевич Александр RSD Russia Alexandr.Shakhlevich@imperva.com © 2014 Imperva, Inc. All rights reserved. 1 Confidential
- 2. О чем говорят СМИ? © 2014 Imperva, Inc. All rights reserved. 2 Confidential
- 3. © 2014 Imperva, Inc. All rights reserved. Industrialization of Hacking Fraud Hacktivism DDoS
- 4. Независимая аналитика – Verizon DBIR 2014 © 2014 Imperva, Inc. All rights reserved. 4 Confidential
- 5. Типы злоумышленников, в % от общего числа инцидентов © 2014 Imperva, Inc. All rights reserved. 5 Confidential
- 6. Мотивация и вектора атакинцидентов, в % от общего числа инцидентов © 2014 Imperva, Inc. All rights reserved. 6 Confidential
- 7. Атаки на Web – самая распространенная разновидность атак © 2014 Imperva, Inc. All rights reserved. 7 Confidential
- 8. Обзор способов атак по различным вертикалям экономики © 2014 Imperva, Inc. All rights reserved. 8 Confidential
- 9. CISO Survey 2013: Угрозы и риски The CISOs see more than 50% of their security risks coming from application security © 2014 Imperva, Inc. All rights reserved. 9 Confidential https://owasp.org/index.php/CISO_Survey_2013:_Threats_and_risks External threats are on the rise More than 70% of CISOs noted that internal threats are staying pretty much on the same level, while over 80% can see external threats clearly on the rise… …When reviewing which areas are the main areas of risk for their organizations, CISOs were very clear that Application Security concerns are now taking center stage in their risk management… …CISOs could in fact clearly confirm that these threats are having negative impacts for their companies
- 10. Решения Imperva SecureSphere WAF © 2014 Imperva, Inc. All rights reserved. 10 Confidential
- 11. Вектора атак, Verizon DBIR 2013 © 2014 Imperva, Inc. All rights reserved. Персональные данные, финансовая информация Интеллектуальная собственность, конкурентные преимущества
- 12. Не забудьте защитить свой самый ценный актив – приложения, БД, файловые сервера! © 2014 Imperva, Inc. All rights reserved.
- 13. Комплексный портфель решений Единая комплексная платформа для защиты корпоративных информационных хранилищ и бизнес-систем © 2014 Imperva, Inc. All rights reserved. Internal Employees Malicious Insiders Compromised Insiders Data Center Systems and Admins Auditing and Reporting Attack Protection Usage Audit User Rights Management Access Control Tech. Attack Protection Logic Attack Protection Fraud Prevention External Customers Staff, Partners Hackers User Rights Management Assessment & Risk Management
- 14. Imperva SecureSphere Комплексное решение для защиты данных Простота развертывания и администрирования Соответствие стандартам информационной безопасности, в том числе ФСТЭК №17, 21 Собственный исследовательский центр Повышение эффективности © 2014 Imperva, Inc. All rights reserved.
- 15. Imperva SecureSphere Пожалуй лучший Web Application Firewall Гранулированная многоуровневая защита Простое внедрение в любую инфраструктуру Удобное и простое управление с технологией Dynamic Profiling © 2014 Imperva, Inc. All rights reserved. И многое другое...
- 16. Комплексная безопасность требует продуманной защиты приложений Dynamic Profiling Attack Signatures HTTP Protocol Validation Cookie Protection IP Reputation Anti-Scraping Policies Bot Mitigation Policies Web Fraud Detection © 2014 Imperva, Inc. All rights reserved. Technical Attack Protection Business Logic Attack Protection Fraud Prevention Correlated Attack Validation IP Geolocation
- 17. Сигнатуры Imperva определяют попытки сканирования и сами атаки Центр Imperva ADC исследует новые угрозы по всему миру © 2014 Imperva, Inc. All rights reserved. Imperva Application Defense Center Internal Users Web Servers SecureSphere INTERNET Системы SecureSphere обладают новейшими противомерами Определение сканирования сети и самих атак с помощью сигнатур
- 18. SecureSphere надежно защищает от атак типа SQL Injection, XSS Hacker SecureSphere © 2014 Imperva, Inc. All rights reserved. WAF /login.php?ID=5 or 1=1 SQL Injection Engine блокирует даже нетиповые атаки SQL Injection SQL Injection Engine with Profile Analysis Signature, Protocol Violations Блокирование однозначных соответствий, отправка подозрительных запросов на дополнительный анализ Продвинутый многоступенчатый анализ значительно снижает уровень ложных срабатываний Web Server
- 19. SecureSphere «изучает» все обращения к защищаемому приложению Анализируя трафик, SecureSphere Параметры © 2014 Imperva, Inc. All rights reserved. автоматически учит… Directories URLs Ожидаемое поведение пользователя Может как оповещать, так и блокировать отклонения от нормы
- 20. Динамическое профилирование во времени Сокращение сроков развертывания с месяцов до дней Снимает нагрузку с администраторов 5-15 изменений в неделю равноценны 5-30 человекочасам конфигурирования 700 600 500 400 300 200 100 0 636 243 32 33 76 55 40 25 21 11 13 28 24 18 1-Jun 6-Jun 11-Jun 16-Jun 21-Jun 26-Jun © 2014 Imperva, Inc. All rights reserved. 41 7 4 5 7 4 8 11 15 2 3 4 1 Дата Изменение профиля Изучение приложения и поведения Адаптация к изменениям
- 21. Наследуемые или устаревшие приложения В момент слияния компания А взяла на поддержку информационные системы компании Б: Стоимость доработки и исправления исчисляется миллионами и занимает длительный срок Нельяза использовать в сетях общего пользования без должной защиты Объединение компаний привело к объединению доменов и потребности дополнительной настройки прав доступа © 2014 Imperva, Inc. All rights reserved. Imperva SecureSphere WAF: Закрытие уязвимостей Периодическое сканирование позволяет поддерживать статус Vulnerable Legacy Application
- 22. IPS & NG Firewall Web Security Features Dynamic Profiling Attack Signatures HTTP Protocol Validation Cookie Protection IP Reputation Anti-Scraping Policies Bot Mitigation Policies Web Fraud Detection © 2014 Imperva, Inc. All rights reserved. Technical Attack Protection Business Logic Attack Protection Fraud Prevention IP Geolocation Correlation (Web Profile Correlation) Высокий уровень ложных срабатываний из-за недостаточного понимания структуры и логики приложения Легкая добыча для хакеров из-за уязвимостей самого приложения
- 23. Основные отличия Imperva WAF по мнению Gartner © 2014 Imperva, Inc. All rights reserved.
- 24. Gartner MQ for Web Application Firewalls © 2014 Imperva, Inc. All rights reserved. 24 Confidential Imperva SecureSphere WAF – единственный ЛИДЕР в области межсетевых экранов для web-приложений*
- 25. Концепция WAF Testing Framework (WTF) • Инструмент для определения реальной эффективности существующих IPSNGFWWAF в части защиты от атак на веб • Комбинация легитимного и вредоносного трафика • Оценка двух параметров: • Блокировка полезного трафика (False Positives) • Пропуск вредоносного трафика (False Negatives) • Дает наглядное представление о балансе между безопасностью и непрерывностью бизнеса • Скачивание и тестирование – бесплатно! © 2014 Imperva, Inc. All rights reserved.
- 26. OWASP-TOP10, 2013 © 2014 Imperva, Inc. All rights reserved. 26 Confidential
- 27. Что такое OWASP Top 10? © 2014 Imperva, Inc. All rights reserved. 27 Confidential
- 28. OWASP 2013 List © 2014 Imperva, Inc. All rights reserved. 28 Confidential https://owasp.org/index.php/CISO_Survey_2013:_Threats_and_risks
- 29. A1-Injection OWASP Top 10 Definition Injection flaws, such as SQL, OS, and LDAP injection, occur when an application sends untrusted data to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization. Injection flaws are very prevalent, particularly in legacy code. The impact is usually very severe as the entire database can be read or modified. © 2014 Imperva, Inc. All rights reserved. 29 Confidential
- 30. A1 – Web Correlation Policy The SQL injection defense algorithm developed by the ADC combines information from the Web Application Profile (positive security model) and matches this information with Attack Signatures (negative security model) using SecureSphere’s Correlated Attack Validation engine. SecureSphere using pre-defined signatures blocks additional injection attacks such as LDAP, XPath, and OS injection. Examples of anomalies detected by the Web application profile security rules include: • If an attacker attempts to change the values of parameters that were fixed by the Web application and should not be changed, SecureSphere will alert and block the request • If a parameter length exceeds the expected maximum length, SecureSphere will alert and block such an evasion attempt • If a parameter includes unexpected characters, such as quotation marks, angle brackets, and asterisks, that do not fit the application profile, SecureSphere will alert and block the request © 2014 Imperva, Inc. All rights reserved. 30 Confidential
- 31. A2 Broken Authentication and Session Management OWASP Top 10 Definition Application functions related to authentication and session management are often not implemented correctly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities. Developers frequently build custom authentication and session management schemes, but building these correctly is hard. Authentication flaws may allow some or even all accounts to be attacked. Once successful, the attacker can do anything the victim could do. Privileged accounts are frequently targeted. © 2014 Imperva, Inc. All rights reserved. 31 Confidential
- 32. A2 Broken Authentication and Session Management cont. Web Correlation Policy - Session Attribute Changes • Source IP Set to Exact Source IP Cookie Signing Policy Set • Encrypt Cookie Value • Cookie Set to sessionid SecureSphere stops session attacks such as: • Session hijacking • Session fixation • Session tampering Web Profile Policy • Cookie Injection enabled • Cookie Tampering enabled • Sessionid set to protect and injection selected • SecureSphere Tracks and Enforces Session Variables. • It learns Cookies and monitors cookie Tampering and Injection. • Application User Tracking attaches User to a session and associates a User with subsequent activity. • In Reverse Proxy, SecureSphere can sign and encrypt cookies. © 2014 Imperva, Inc. All rights reserved. 32 Confidential
- 33. A3 Cross-Site Scripting (XSS) OWASP Top 10 Definition Cross-Site Scripting (XSS) is the most prevalent Web application security flaw. XSS flaws occur whenever an application takes untrusted data and sends it to a Web browser without proper validation or escaping. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface Web sites, or redirect the user to malicious sites. Detection of most XSS flaws is fairly easy via testing or code analysis © 2014 Imperva, Inc. All rights reserved. 33 Confidential
- 34. A3 Web Correlation Policy SecureSphere Mitigation Summary • Utilizing Positive (White List) and Negative (Black list) detection techniques • Accurate detection of suspicious XSS Keywords, Patterns and Signatures. • Dynamic Profiling builds accurate parameter usage baseline. • Input is normalized to detect different evasion attempts (HTML, Hex and Unicode encoding) • Out-Of-The-Box Web-Correlation XSS policy. © 2014 Imperva, Inc. All rights reserved. 34 Confidential
- 35. Вопросы? www.imperva.com Alexandr.shakhlevich@imperva.com © 2014 Imperva, Inc. All rights reserved. 35 Confidential
Editor's Notes
- September 10, 2014
- May 21, 2007
- The SecureSphere Web Application Firewall provides the defenses that are needed to stop threats like Anonymous and other hacktivist groups, cybercriminals, and state-sponsored hackers. First, SecureSphere offers multiple layers of defense to stop technical attacks that exploit application vulnerabilities, like SQL injection and cross-site scripting. SecureSphere provides Dynamic Profiling to learn protected applications and identify unusual activity. Attack signatures stop known attacks. HTTP protocol validation prevents evasion techniques like double encoding and redundant headers. SecureSphere monitors cookies and sessions and can sign or encrypt cookies to stop cookie poisoning and session hijacking attacks. And IP reputation awareness recognizes known malicious users. SecureSphere offers many more defenses like Web worm protection and data leak protection, but these are the most essential to stopping technical attacks. ++++++++++++++ In addition, SecureSphere stop business logic attacks like site scraping, comment spam, parameter tampering and application DDoS. It uses reputation-based security and pre-defined security policies that detect excessive requests and bots. In addition, SecureSphere offers geolocation to detect and block sources from undesirable countries. +++++++++++++++ Lastly, SecureSphere prevents fraud by detecting devices that are infected with malware, are suspicious or have performed fraudulent transactions in the past. ++++++++++++++++ And we offer pre-defined and custom policies that can combine these defenses for extremely accurate attack detection.
- May 21, 2007
- May 21, 2007
- May 21, 2007
- May 21, 2007
- A fortune 100 US bank inherited a treasury application as part of the acquisition of another bank. Web application scans found that the application had 57 vulnerabilities which would cost millions of dollars to fix. The acquiring bank wouldn’t allow vulnerable apps into their own datacenter. So they needed to fix the application quickly or pay to keep the old datacenter open just to host the legacy application. They planned to replace the application and they didn’t want to invest a lot of resources to manually fix the vulnerabilities. With the SecureSphere WAF, the bank was able to mitigate all of the vulnerabilities found by the scan. Periodic scans performed by the bank confirm that the treasury application is still secure.
- If you compare Web Application Firewalls to Intrusion Prevention Systems and Next Generation Firewalls, the differences are clear. While these products may contain a handful of attack signatures, they are not effective at stopping Web application attacks. They do not have sophisticated security engines that can analyze Web application profile violations, keywords, and protocol violations together to correctly identify Web attacks. Secondly, they can’t stop threats like bots or protect cookies or sessions. They typically do not offer any type of reputation-based protection and if they do, it is focused on email spammers, not Web threats. Moreover, IPS’s cannot stop business logic attacks like site scraping and application DDoS and they can’t prevent Web fraud. In addition, many IPS products can’t even decrypt SSL traffic. +++++++++++++++++++++++++ Because of this, IPS’s suffer from a high rate of false positives and false negatives when attempting to stop Web application attacks. In addition, it is easy for hackers to evade them by using encoding or exploiting custom application vulnerabilities. Businesses that wish to avoid the painful consequences of a Web application attack need to deploy a Web application firewall.