Advanced security in Barracuda WAF
Download as PPTX, PDF0 likes378 views
The document provides information on advanced security topics in Barracuda Web Application Firewall including: - URL policies and modules like bruteforce prevention and antivirus that can be activated in policies - Allow/deny rules for URLs and headers to control access and enforce limitations - Website profiles that apply fine-grained security settings through URL and parameter profiles - Tools for tuning security rules like web firewall logs, trusted hosts, and exception profiling - URL encryption to encrypt URLs in requests and responses for added protection - Defenses against application DDoS attacks using IP reputation filtering and DDoS policies
Advanced security in Barracuda WAF
- 1. Advanced Security Topics Covered: • URLPolicies • Bruteforce Prevention • Antivirus Module 4–Chapter 3
- 2. URL Policies • Automatically createdforeachService • Additional URL Policies can be created forspecific partsof aWeb App • Modulesthatcanbeactivated in URLPolicies: • DataTheftPrevention • Bruteforce Prevention • Antivirus • RateControl (alsoavailableatService level) • 4.3 – Advanced Security
- 3. Advanced Security • 4.3 – Advanced Security Response Application Server Tommy Request
- 4. Antivirus • Virusscanningisenabled ona per-URLbasis • ShouldonlybeenabledforURLswhich allowfile uploadsanddownloads • Clam AV • Barracudacreatesthe AVsignatures pushedthrough Energize Updates • 4.3 – Advanced Security Eisenberg WAF Web Server Request blocked EU
- 5. Bruteforce Protection • Maximumnumberof requeststo aURLwithinaconfigured interval • Allrequests oronlyinvalidrequests • From asingle clientorfromallsources • 4.3 – Advanced Security WAF Web Server Bruteforce tommy/password 2 1 Requests 1 2 Request blocked Eisenberg 1.1.1.1 tommy/123456 3 tommy/qwerty 4 tommy/abc123 360s1.1.1.1
- 6. Session Tracking • Limits thenumberof sessions originating from aparticularclientIP addressina given interval • Helps prevent session-based Denial of Service(DoS) attacks • 4.3 – Advanced Security WAF Web Server Session Trck. Request blocked Eisenberg 1.1.1.1 60s1.1.1.1 Request3 Request2 SessionID2 Request1 SessionID1 Request2 SessionID2 Request1 SessionID1
- 7. Advanced Security Configuration • WEBSITES> AdvancedSecurity • Edit thedefault-URL-policy • Enable Data Theft Protection • Enable AV • Enable Bruteforce Protection • Enable Rate Control • Session Trackingwalkthrough • EnableClickjackingProtection • 4.3 – Advanced Security Live Demo
- 8. Allow/Deny Rules Topics Covered: • Overview • Allow/Deny RulesTypes • ExtendedMatchRules • RuleEvaluation Order Module 4–Chapter 4
- 9. Allow/Deny Rules • Define strictaccesscontrol rulesforthe services • Rulesareservice-specific andcannotbeshared • Two typesof rules: • Allow/Deny rulesforURLs • Allow/Denyrulesforheaders • 4.4 – Allow/Deny Rules
- 10. Allow/Deny Rules • 4.4 – Allow/Deny Rules Response Application Server Tommy Request
- 11. Allow/Deny Rules for URLs • Control accessto certainportionsto theWeb Applicationbasedon a set of matchingcriteria • WithoutchanginganyconfigurationontheWebApplicationitself • Extendedmatchcanbeused • Configurableactionsare the same asglobal ACLs • 4.4 – Allow/Deny Rules Web Application Public Private Payments Access Control
- 12. Allow/Deny Rules for Headers • Enforcestrictlimitations onincoming headers • Sanitize HTTP headerscontaining • Sensitive informationidentifyingthe client • Someapplication-specificstateinformation • Prevent configured attacktypes • Stop potentially malicious metacharactersandkeywords • 4.4 – Allow/Deny Rules
- 13. Extended Match Rules • Specifically define whichrequests/responsesneedtherule applied • Conditionscanbe based on foundparametersor elements • Used acrossmultiple modules (notonly Allow/Denyrules) • 4.4 – Allow/Deny Rules Tommy Firefox 16 WAF USER-Agent co Firefox/16 Application Server URL Allow/Deny Rule Request Response 301 - Update_your_browser.html
- 14. Extended Match Rules Configuration • 4.4 – Allow/Deny Rules 1 2 3 4 5 Extended Match Widget 1. OpentheExtendedMatchwidget 2. Configurewhattointercept 3. InsertconditionintheHeader Expressionfield 4. Apply/Closewidget 5. 1=highestpriority
- 15. Rule Evaluation Order • The policies of the“bestmatching”ruleareapplied • Hierarchical match • ComparestheHostheader.Ifthereisnomatch,comparestheURLpath • Ifmultiple ACLsmatch,eachextendedmatchruleisevaluatedinascending orderofextendedmatchsequence • Sequential match • IgnorestheHostheaderandURLpath • Eachextendedmatchruleisevaluatedinsequentialorder basedonthe extendedmatchsequence • 4.4 – Allow/Deny Rules
- 16. Allow/Deny Rules • WEBSITES> Allow/DenyRules • CreateaURLAllow/Deny rule • CreateaHeadersAllow/Denyrule • 4.4 – Allow/Deny Rules Live Demo
- 17. Website Profiles Topics Covered: • Overview • URLProfiles • ParameterProfiles • AdaptiveProfiling • URLEncryption Module 4–Chapter 5
- 18. Website Profiles Overview • Specific rules tofine-tunethesecuritysettingsof a service • URLprofiles • Parametersprofiles Tommy Reed WAF /cgi-bin/reg.cgi URL Profile /cgi-bin/reg.cgi Request Parameters Profile First Name • Input Field • Type Alpha • Max Char 16 Last Name • Input Field • Type Alpha • Max Char 16 /cgi-bin/reg.cgi Request Application Server Tommy Reed • 4.5 – Website Profiles
- 19. Website Profiles • 4.5 – Website Profiles Response Application Server Tommy Request
- 20. Website Profiles Modes • Active - Validates requests,blocks, andlogs requestsviolations • UseURLprofileandcorresponding parameterprofile(s) settings • Passive - Validates the requestsand logs violations • Learning- LearnstheWeb Application structure… • 4.5 – Website Profiles
- 21. Website Profiles - Strict Profile Check • Enforcethepositiveornegativesecuritymodel • StrictProfileCheckenabled: • ValidatesrequestsanddeniestherequeststhatdonotmatchtheURLprofilesandparameter profiles • StrictProfileCheckdisabled: • Validatesrequests,andiftheydonotmatchtheURLprofilesandparameterprofiles,therequests arevalidatedagainsttheglobalsecuritypolicy. • 4.5 – Website Profiles
- 22. Adaptive Profiling • Automatically learnsthestructureof aWeb Application • Basedonrequests and/orresponses • Available onmodel660+ • Creates the website profile based on thelearnedstructure • 4.5 – Website Profiles Tommy Reed WAF /cgi-bin/reg.cgi URL Profile /cgi-bin/reg.cgi Request Parameters Profile First Name • Input Field • Type Alpha Last Name • … /cgi-bin/reg.cgi Request Application Server Tommy Reed ResponseResponse
- 23. Adaptive Profiling Configuration 1. Configure theservice in Learningmode 2. Startthelearningprocess • GeneratetraffictotheWebApplication 3. Stop thelearningprocess 4. Review and Lock theURL Profiles ConfigurationsettingsinWEBSITES>WebsiteProfiles • 4.5 – Website Profiles 2 3 1 2 4
- 24. Website Profiles Configuration • WEBSITES> Websites Profiles • CreateanewURLprofile • Createanewparameterprofile • WEBSITE >Adaptive Profiling • Addanadaptiveprofiling rule • WEBSITES> Websites Profiles • Configure thewebsiteprofiletolearn • 4.5 – Website Profiles Live Demo
- 25. Tuning Security Rules Topics Covered: • Web Firewall Logs • TrustedHosts • ExceptionProfiling Module 4–Chapter 6
- 26. Web Firewall Logs • Traffic violations arelogged in theWeb Firewall Log • Canbeusedto mitigate false positives • Suggeststhe recommended “Fix” • Acceptinga recommendation could have thefollowing impact: • Localized-Website profilemodification(URLorparameter) • Global- Securitypolicymodification • 4.6 – Tuning Security Rules
- 27. Trusted Hosts • Hosts whose trafficis assumed tobe safe • DefinedbyIPaddress/network • Configured ingroups • Use cases • Exemptspecific trafficfromsecuritychecksorauthentication • TraintheAdaptiveProfiling engine • TraintheExceptionProfiling engine • 4.6 – Tuning Security Rules
- 28. Exception Profiling • Fine-tunessecuritypolicies associated witha service • Uses a heuristics-basedstrategy to refine securitysettingsinresponse to logged traffic Tommy WAF Service Security Settings Exception Profiling Max File size Upload - 5 Mb 6 Mb7 Mb8 Mb Request blocked Increase by 100% Max File size Upload - 10 Mb Level LOW - Trigger Count: 3 - New Value: +100% • 4.6 – Tuning Security Rules
- 29. Exception Profiling Heuristics • Changescanbesuggestedorapplied automatically • Trustedtraffic • Trusted(Hosts) • Untrustedtraffic • Low • Medium • High • Untrustedtraffic levels are shared among services • 4.6 – Tuning Security Rules
- 30. Tuning Security Rules Configuration • BASIC >Web Firewall Logs • Reviewfalsepositives andapplythefix • WEBSITES> TrustedHosts • Configure anewgroup andapplyittoaservice • WEBSITES> ExceptionProfiling • Assign ExceptionProfile leveltoaservice • WEBSITES> ExceptionHeuristics • Levelswalkthrough • 4.6 – Tuning Security Rules Live Demo
- 31. URL Encryption • TheWAF encryptsall URLsassociated withtherequestedpage • Requiresnochangesto the application • If encryptedURLsare manipulatedor tamperedwithinsubsequent requests,therequestsare blockedandlogged • 4.3 – Advanced Security WAF Tommy Application Server http://bn.com Request http://bn.com Request http://bn.com/index.php?include=a.txt Response http://bn.com/d098duj0 Response
- 32. URL Encryption Configuration • WEBSITES> URLEncryption • Activate URLencryptiononaservice • Addanewencryptionrule • BASIC >AccessLogs • VerifyencryptedURLs • 4.3 – Advanced Security Live Demo
- 33. Application DDoS Attack Protection Topics Covered: • IP Reputation Filter • DDoSPolicies • Slow Client AttackPrevention Module 4–Chapter 7
- 34. IP Reputation Filter • Filters trafficfrom specific geographic regions / categories to aservice • GeoPool • BarracudaReputation • TORNodes • AnonymousProxy • SatelliteProvider WAF Requests Requests blocked Backend Servers • 4.7 – Application DDoS Attack Protection
- 35. DDoS Policies • Passively evaluate theclientsto determineif theyare suspiciousor not • The client taggedas suspiciouswill be forcedto answera CAPTCHA • Thesuspicious clientIPaddresses will beremembered for900seconds BOT Request WAF Web Server Request ResponseResponse JS Request Request blocked Response C4PtcH4 • 4.7 – Application DDoS Attack Protection
- 36. Slow Client Attack Prevention • Enforcesrequests/ responsestimeouts • Enforcesrequests/ responsesminimumdata transferrates • Prevents: • SlowHTTPheadersvulnerability(Slowloris) • SlowHTTPPOSTvulnerability(R-U-Dead-YetorRUDY) • SlowreadDoSattack • 4.7 – Application DDoS Attack Protection
- 37. Application DDoS Attack Protection • WEBSITES> IP Reputation • Configuration walkthrough • WEBSITES> DDoSPrevention • CreateanewDDoSpolicy • Edit theSlow ClientAttackPreventionsettings • 4.7 – Application DDoS Attack Protection Live Demo