Copyright 2006 - The OWASP Foundation

Permission is granted to copy, distriute and!or modi"y this document

under the terms o" the #$% Free &ocumentation 'icense(
The OWASP Foundation
OWASP
AppSec
Europe
)ay 2006
http*!!+++(o+asp(org!
Web Application Firewalls:
When Are They Useful?
Ian !istic
Thin"in# Stone
i,anr-+e.reator(com
/00 1166 203 240
$ OWASP AppSec Europe $%%&
Ian !istic

We App5ication Security
specia5ist6 &e,e5oper(

Author o" Apache Security(

Founder o" Thin"in# Stone(

Author o" 'odSecurity(

( OWASP AppSec Europe $%%&
Why Use Web Application Firewalls?

7n the nutshe55*
4( We app5ications are dep5oyed terri5y insecure(
2( &e,e5opers shou5d, o" course, continue to stri,e to
ui5d etter!more secure so"t+are(
8( 9ut in the meantime, sysadmins must do something
aout it( :Or, as 7 5i.e to say* We need ery help
we can #et(;
)* Insecure applications aside+ WAFs are an
i,portant buildin# bloc" in eery -TTP
networ"*
) OWASP AppSec Europe $%%&
.etwor" Firewalls /o .ot Wor" For -TTP
Firewall
Port 80
HTTP Traffic
Web
Client
Web
Server
Application
Application
Database
Server
0 OWASP AppSec Europe $%%&
WAFE1 234

Web Application Firewall Ealuation

1riteria(

Pro<ect o" the We App5ication Security

Consortium :+eappsec(org;(

7t=s an open pro<ect(

$ine WAF ,endors on oard, ut I5d li"e to see

,ore users on the list*

WAF>C ,4(0 pu5ished in ?anuary(

We are aout to start +or. on ,4(4(

& OWASP AppSec Europe $%%&
WAFE1 2$4

$ine sections*
3* /eploy,ent Architecture
$* -TTP and -T'6 Support
(* /etection Techni7ues
)* Preention Techni7ues
0* 6o##in#
6( @eporting
1( )anagement
3( Per"ormance
A( B)'
8 OWASP AppSec Europe $%%&
WAFE1 2(4
WAF>C is not "or
the ,endors(
It5s for the users*
2So please oice your opinions94
http:::www*webappsec*or#:pro;ects:wafec:
< OWASP AppSec Europe $%%&
WAF Identity Proble, 234

There is a 5ong-standing WAF identity pro5em(

With the na,e, "irst o" a55C*

We Adapti,e Fire+a55
Web Application Firewall
We App5ication Security &e,ice
We App5ication ProDy
We App5ication Shie5d
We Shie5d
We Security Fire+a55
We Security #ate+ay
We Security ProDy
We 7ntrusion &etection System
We 7ntrusion Pre,ention System
Adapti,e Fire+a55
Adapti,e ProDy
Adapti,e #ate+ay
App5ication Fire+a55
App5ication-5e,e5 Fire+a55
App5ication-5ayer Fire+a55
App5ication-5e,e5 Security #ate+ay
App5ication 'e,e5 #ate+ay
App5ication Security &e,ice
App5ication Security #ate+ay
State"u5 )u5ti5ayer 7nspection
Fire+a55
List compiled by Achim Hoffmann.
= OWASP AppSec Europe $%%&
WAF Identity Proble, 2$4

There are "our aspects to consider*

3* Audit deice
$* Access control deice
(* 6ayer 8 router:switch
)* Web Application -ardenin# tool

These are a55 ,a5id reEuirements ut the name

Web Application Firewall is not suita5e(

On the 5o+er net+or. 5ayers +e ha,e a

di""erent name "or each "unction(
3% OWASP AppSec Europe $%%&
WAF Identity Proble, 2(4

App5iance-oriented +e app5ication "ire+a55s

clash +ith the Application Assurance
,ar"et(

Pro5ems so5,ed 5ong time ago*

'oad a5ancing

C5ustering

SS' termination and acce5eration

Caching and transparent compression

%@' re+riting

Fand so on
33 OWASP AppSec Europe $%%&
WAF Identity Proble, 2)4

Gey "actors*
4( App5ication Assurance ,endors are ,ery strong(
2( We App5ication Fire+a55 ,endors not as much(

@esu5t*

Appliance>oriented WAFs are bein#

assi,ilated by the Application Assurance
,ar"et*

7n the meantime*

E,bedded WAFs are left alone because they

are not an all>or>nothin# proposition*
3$ OWASP AppSec Europe $%%&
WAF Functionality
Overview
3( OWASP AppSec Europe $%%&
The Essentials 234

Full support for -TTP*

Access to indi,idua5 "ie5ds :"ie5d content, 5ength, "ie5d

count, etc;(

>ntire transaction :oth reEuest and response;(

%p5oaded "i5es(

Anti>easion features :a5so .no+n as

norma5isation!canonica5isation!trans"ormation
"eatures;(
3) OWASP AppSec Europe $%%&
The Essentials 2$4

?loc"in# features*

Transaction

Connection

7P Address

Session

%ser

Honeypot redirection

TCP!7P resets :connection;

95oc.ing ,ia eDterna5 de,ice

What happens upon detection?

30 OWASP AppSec Europe $%%&
Fancy Features

Stateful operation:

7P Address data

Session data

%ser data

Eent 1orrelation

-i#h aailability:

Fai5o,er

'oad-a5ancing

C5ustering

State rep5ication
3& OWASP AppSec Europe $%%&
-ard>1oded Protection Techni7ues 234

1oo"ie protection

Sign!encrypt!,irtua5ise

-idden field protection

Sign!encrypt!,irtua5ise

Session ,ana#e,ent protection

>n"orce session duration timeout, inacti,ity timeout(

Pre,ent "iDation(

Iirtua5ise session management(

Pre,ent hi<ac.ing or at 5east +arn aout it(

38 OWASP AppSec Europe $%%&
-ard>1oded Protection Techni7ues 2$4

?rute>force protection

6in" alidation

Signing

Iirtua5isation

!e7uest flow enforce,ent

Statica55y

&ynamica55y
3< OWASP AppSec Europe $%%&
Other Thin#s To 1onsider 234

'ana#e,ent*

7s it possi5e to manage mu5tip5e sensors "rom one p5aceJ

Support "or administrati,e accounts +ith di""erent pri,i5eges

:oth horisonta5 and ,ertica5;(

!eportin# :gi,ing )anagement +hat it +ants;*

On-demand and schedu5ed reports +ith support "or cus

@'6*

WAFs are eDpected to pro,ide asic support "or B)' parsing

and ,a5idation(

Fu55 B)' support is usua55y a,ai5a5e as an option, or as a

comp5ete5y separate product(
3= OWASP AppSec Europe $%%&
Other Thin#s To 1onsider 2$4

EAtensibility*

7s it possi5e to add custom "unctiona5ity to the

"ire+a55J

7s the source code a,ai5a5eJ :9ut not as a

rep5acement "or a proper AP7(;

Perfor,ance*

$e+ connections per second(

)aDimum concurrent connections(

Transactions per second(

Throughput(

'atency(
$% OWASP AppSec Europe $%%&
Sinatures and
!ules
$3 OWASP AppSec Europe $%%&
Si#natures or !ules?
3* Si#natures

Simp5e teDt strings or regu5ar eDpression patterns

matched against input data(

$ot ,ery "5eDi5e(

$* !ules
4( F5eDi5e(
2( )u5tip5e operators(
8( @u5e groups(
0( Anti-e,asion "unctions(
2( 'ogica5 eDpressions(
6( Custom ,aria5es(
$$ OWASP AppSec Europe $%%&
Three Protection Strate#ies
3* EAternal patchin#

A5so .no+n as K<ust-in-time patchingK or K,irtua5 patchingK;(

$* .e#atie security ,odel

'oo.ing "or ad stu""(

Typica55y used "or We 7ntrusion &etection(

>asy to start +ith ut di""icu5t to get right(

(* Positie security ,odel

Ieri"ying input is correct(

%sua55y automated, ut ,ery di""icu5t to get right +ith

app5ications that change(

7t=s ,ery good ut you need to set your eDpectations

according5y(
$( OWASP AppSec Europe $%%&
Auditin and H""#
"raffic $onitorin
$) OWASP AppSec Europe $%%&
Web Intrusion /etection

O"ten "orgotten ecause o" mar.eting

pressures*

/etection is so 5ast year :decade;(

Preention sounds and se55s much etterL

The pro5em +ith pre,ention is that it is bound

to fail gi,en su""icient5y determined attac.er
:or ineDperienced WAF operator;(

'onitorin# :5ogging and detection; is actua55y

more important as it a55o+s you to
independent5y audit tra""ic, and go ac. in
time(
$0 OWASP AppSec Europe $%%&
'onitorin# !e7uire,ents

Centra5isation(

Transaction data storage(

Contro5 o,er which transactions are lo##ed

and which parts of each transaction are
5ogged, dyna,ically on the per>transaction
asis(

)inima5 in"ormation :session data;(

Partia5 transaction data(

Fu55 transaction data(

Support "or data sanitisation(

Can imp5ement your retention po5icy(

$& OWASP AppSec Europe $%%&
Deployment
$8 OWASP AppSec Europe $%%&
/eploy,ent

Three choices +hen it comes to

dep5oyment*
3* .etwor">leel deice(
$* !eerse proAy(
(* E,bedded in web serer(
$< OWASP AppSec Europe $%%&
/eploy,ent 2$4
4( $et+or.-5e,e5 de,ice
Does not re%uire networ& re'confiuration.
$= OWASP AppSec Europe $%%&
/eploy,ent 2(4
2( @e,erse proDy
"ypically re%uires networ& re'confiuration.
(% OWASP AppSec Europe $%%&
/eploy,ent 2)4
8( >medded
Does not re%uire networ& re'confiuration.
(3 OWASP AppSec Europe $%%&
/eploy,ent 204
4( $et+or. passi,e

&oes not a""ect per"ormance(

>asy to add(

$ot a ott5enec. or a point o" "ai5ure(

'imited pre,ention options(

)ust ha,e copies o" SS' .eys(

2( $et+or. in-5ine

A potentia5 ott5enec.(

Point o" "ai5ure(

)ust ha,e copies o" SS' .eys(

>asy to add(
($ OWASP AppSec Europe $%%&
/eploy,ent 2&4
8( @e,erse proDy

A potentia5 ott5enec.(

Point o" "ai5ure(

@eEuires changes to net+or. :un5ess it=s a

transparent re,erse proDy;(

)ust terminate SS' :can e a pro5em i" app5ication

needs to access c5ient certi"icate data;(

It5s a separate architecture:security layer*

0( >medded

>asy to add :and usua55y much cheaper;(

$ot a point o" "ai5ure(

%ses +e ser,er resources(

(( OWASP AppSec Europe $%%&
!eerse ProAy As a ?uildin# ?loc"

@e,erse proDy patterns*

4( Front door
2( 7ntegration re,erse proDy
8( Protection re,erse proDy
0( Per"ormance re,erse proDy
2( Sca5ai5ity re,erse proDy

'ogica5 patterns, orthogona5 to

each other(

O"ten dep5oyed as a sing5e physica5

re,erse proDy(
() OWASP AppSec Europe $%%&
Front /oor 23:04

)a.e a55 HTTP tra""ic go through the proDy

Centra5isation ma.es access contro5,

5ogging, and monitoring easier
(0 OWASP AppSec Europe $%%&
Inte#ration !eerse ProAy 2$:04

Comine mu5tip5e +e ser,ers into one

Hide the interna5s

&ecoup5e inter"ace "rom imp5ementation

(& OWASP AppSec Europe $%%&
Protection !eerse ProAy 2(:04

Oser,es tra""ic in and out

95oc.s in,a5id reEuests and attac.s

Pre,ents in"ormation disc5osure

(8 OWASP AppSec Europe $%%&
Perfor,ance !eerse ProAy 2):04

Transparent caching

Transparent response compression

SS' termination
(< OWASP AppSec Europe $%%&
Scalability !eerse ProAy 20:04

'oad a5ancing

Fau5t to5erance

C5ustering
(= OWASP AppSec Europe $%%&
Open Source
Approach( Apache
) $odSecurity
)% OWASP AppSec Europe $%%&
Apache

One o" the most used open source products(

A,ai5a5e on many p5at"orms(

Free, "ast, sta5e and re5ia5e(

>Dpertise +ide5y a,ai5a5e(

Apache 2(2(D :"ina55yL; re5eased +ith many

impro,ements*

7mpro,ed authentication(

7mpro,ed support "or caching(

Signi"icant impro,ements to the modMproDy code

:and 5oad a5ancing support;(

Ideal reerse proAy*

)3 OWASP AppSec Europe $%%&
'odSecurity

Adds WAF "unctiona5ity to Apache(

7n the )
th
year o" de,e5opment(

Free, open source, commercia55y supported(

7mp5ements most WAF "eatures :and the

remaining ones are coming soon;(

Popu5ar and ,ery +ide5y used(

Fast, re5ia5e and predicta5e(

)$ OWASP AppSec Europe $%%&
Apache B 'odSecurity

&ep5oy as reerse proAy*

Pic. a nice ser,er :7 am Euite

"ond o" Sun=s hard+are
o""erings myse5";(

7nsta55 Apache 2(2(D(

Add )odSecurity(

Add SS' acce5eration card

:optiona5;(

Or simp5y run )odSecurity

in e,bedded ,ode(
)( OWASP AppSec Europe $%%&
'odSecurity

Strong areas*

Auditin#:lo##in# support*

!eal>ti,e traffic ,onitorin#*

Cust>in>ti,e patchin#*

Preention*

Dery confi#urable:pro#ra,,able*

Wea. areas*

.o auto,ation of the positie security ,odel

approach yet*
)) OWASP AppSec Europe $%%&
Than" you9
&o+n5oad this presentation "rom
http:::www*thin"in#stone*co,:tal"s:
*uestions+