Implementing a WAF
•
2 gostaram•4,242 visualizações
Presentation @ local Owasp Ireland Chapter on my experiences of implementing a Web Application Firewall
Recomendados
Recomendados
Mais conteúdo relacionado
Mais procurados
Mais procurados (12)
Semelhante a Implementing a WAF
Mais de Mark Hillick
Mais de Mark Hillick (9)
Último
Último (20)
Implementing a WAF
- 1. TRIALS & TRIBULATIONS OF WAF MARK HILLICK - @MARKOFU Thursday 20 May 2010
- 2. AWK -F: '/ROOT/ {PRINT $5}' /ETC/PASSWD Mark Hillick Thursday 20 May 2010
- 3. PHASES Introduction Starting Out Design Test Implementation Post-Implementation Thursday 20 May 2010
- 4. INTRODUCTION - WHAT IS A WAF? Thursday 20 May 2010
- 5. INTRODUCTION - WAF TODAY? WAF Marketplace Maturing Compliance Boo Thursday 20 May 2010
- 6. INTRODUCTION - WAF TODAY? WAF deployments were initially propelled by PCI ......... but are now increasingly driven by security best practices. Source: Forrester 2010 Thursday 20 May 2010
- 7. INTRODUCTION - NUMBERS $200 million 20% Thursday 20 May 2010
- 8. INTRODUCTION - VENDORS Software/Hardware Commercial/Open Source Thursday 20 May 2010
- 9. INTRODUCTION - EH???? WHAT???? XSS XSRF SQL Injection APT Zero Day Click Jacking Cookie/Session Hijacking Thursday 20 May 2010
- 10. INTRODUCTION - COMPETITORS IDS Reverse Proxy IPS Network FW Proxy Secure Code Thursday 20 May 2010
- 11. INTRODUCTION - PRE-SALES Know your subject Question, Ask, Query, Demand Plan, Test, Plan, Test Thursday 20 May 2010
- 12. STARTING OUT - GOAL Thursday 20 May 2010
- 13. STARTING OUT - RESEARCH Research -> knowledge & understanding Thursday 20 May 2010
- 14. STARTING OUT - SATISTICS 6.5 times more expensive to fix a flaw in development than during design, 15 times more in testing, and 100 times more in development. Source http://2010survey.whitehatimperva.com/ Thursday 20 May 2010
- 15. STARTING OUT - INTERNAL SELL (1) Technical issues in business language (e.g. just-in- time patching) and a bit of Thursday 20 May 2010
- 16. STARTING OUT - INTERNAL SELL (2) Know your costs Advantages over cheaper alternatives! Thursday 20 May 2010
- 17. STARTING OUT - INTERNAL SELL (4) There is a disconnect between the acknowledgement of security issues and the willingness to fix them. Source: The HP Security Laboratory Blog Thursday 20 May 2010
- 18. STARTING OUT - INTERNAL SELL (4) Do not oversell WAF != unhackable Thursday 20 May 2010
- 19. STARTING OUT - PLAN (1) I love it when...... Copyright © NBC Thursday 20 May 2010
- 20. STARTING OUT - PLAN (2) WANTED!!!! Owner/Champion/Lover Thursday 20 May 2010
- 21. STARTING OUT - PLAN (3) Thursday 20 May 2010
- 22. STARTING OUT - PLAN (4) UAT & SDLC Configuration - Delegation? Alerting Incident Response Plan Logging & Analysis Reporting Thursday 20 May 2010
- 23. TEST - TEST SOURCE: http://www.flickr.com/photos/ kodomut/ Thursday 20 May 2010
- 24. TEST - SDLC How does it change? When? Who? Thursday 20 May 2010
- 25. TEST - OPERATIONAL Not what you want, is it? Thursday 20 May 2010
- 26. TEST - FUNCTIONAL Functional Generic Specific SOURCE: http://www.flickr.com/photos/ 54724780@N00/ Thursday 20 May 2010
- 27. TEST - STRESS STRESS == LEARNING SOURCE: http://www.flickr.com/photos/ 54724780@N00/ Thursday 20 May 2010
- 28. TEST - THE FUN ‘BIT’ Does it work....... SOURCE: http://nmap.org/movies.html Copyright © Warner Bros. Thursday 20 May 2010
- 29. TEST - POLICY Administration Policy Who has access? Delegation? Change Management - different? Incident Response Plan? What is an Incident? Thursday 20 May 2010
- 30. IMPLEMENTATION - PLAN Plan B? Copyright © Fox Thursday 20 May 2010
- 31. IMPLEMENTATION - ALMOST Almost there, don’t cut corners! COMPLETE TESTING FULLY!!!!! Thursday 20 May 2010
- 32. IMPLEMENTATION - SET-UP +.ve Security Model Transparent Informational Logging Generic versus Specific Analysis Reporting Thursday 20 May 2010
- 33. IMPLEMENTATION - READ Check your logs!!! Thursday 20 May 2010
- 34. IMPLEMENTATION - HACK External Testing Thursday 20 May 2010
- 35. IMPLEMENTATION Transparent -> Blocking Generic -> Specific Thursday 20 May 2010
- 36. POST-IMPLEMENTATION - WAF Your infrastructure has changed!! Patching, Policy Changes, Application Upgrades Thursday 20 May 2010
- 37. POST-IMP - STILL, OH YES? SDLC Network Firewall & ACLs Code Analysis Penetration &Vulnerability Testing Incident Response Plan???? -> Incident? What? Thursday 20 May 2010
- 38. POST-IMP - TICK TOCK, NO MORE!! Thursday 20 May 2010
- 39. POST-IMP - USE IT! NO!!!!!! Thursday 20 May 2010
- 40. POST-IMPLEMENTATION - STILL? As someone-else once said!! Thursday 20 May 2010
- 41. RESOURCES SANS Reading Room (Scareware via Web App exploit) SANS, Owasp, WebAppSec Web 2.0 -> Blogs, Twitter Vendor Sites Thursday 20 May 2010
- 42. CONCLUSION - WAF Extra layer of defence but also admin Can be an excellent and effective solution Is it what I need? Only a part of defence-in-depth!!!! Thursday 20 May 2010