ModSecurity_Core_Rules.pdf

(1031 KB) Pobierz
"The Core Rule Set":
Generic detection of application layer
attacks
Ofer Shezaf
ModSecurity Core Rule Set Project Leader
CTO, Breach Security
Web Application Firewalls
vs.
Intrusion Prevention Systems
Multiple Deployment Modes
Web
Server
In-Line mode
`
Firewall
Web
Server
Embedded mode
Firewall
`
Web
Server
Out of line mode
Firewall
`
Three Protection Strategies for WAFs
1.
2.
External patching
Also known as "just-in-time patching" or "virtual patching".
An independent input validation envelope.
Rules must be adjusted to the application.
Automated and continuous learning (to adjust for changes) is the key.
Looking for bad stuff,
Mostly signatures based.
Generic but requires some tweaking for each application.
Positive security model
3.
Negative security model
IPS?
Virtual Patching
Testing reveals that the login field is vulnerable to SQL
injection.
Login names cannot include characters beside
alphanumerical characters.
The following rule will help:
<LocationMatch "^/app/login.asp$">
SecRule ARGS:username "!^\w+$" "deny,log"
>/LocationMatch>

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin