Presentation @ local Owasp Ireland Chapter on my experiences of implementing a Web Application Firewall

1. TRIALS & TRIBULATIONS OF WAF
MARK HILLICK - @MARKOFU
Thursday 20 May 2010

2. AWK -F: '/ROOT/ {PRINT $5}' /ETC/PASSWD
Mark Hillick
Thursday 20 May 2010

3. PHASES
Introduction
Starting Out
Design
Test
Implementation
Post-Implementation
Thursday 20 May 2010

4. INTRODUCTION - WHAT IS A WAF?
Thursday 20 May 2010

5. INTRODUCTION - WAF TODAY?
WAF Marketplace
Maturing
Compliance
Boo
Thursday 20 May 2010

6. INTRODUCTION - WAF TODAY?
WAF deployments were initially propelled by PCI .........
but are now increasingly driven by security best
practices.
Source: Forrester 2010
Thursday 20 May 2010

7. INTRODUCTION - NUMBERS
$200
million
20%
Thursday 20 May 2010

8. INTRODUCTION - VENDORS
Software/Hardware
Commercial/Open Source
Thursday 20 May 2010

9. INTRODUCTION - EH???? WHAT????
XSS XSRF SQL Injection
APT Zero Day
Click Jacking
Cookie/Session Hijacking
Thursday 20 May 2010

10. INTRODUCTION - COMPETITORS
IDS Reverse Proxy
IPS Network FW
Proxy Secure Code
Thursday 20 May 2010

11. INTRODUCTION - PRE-SALES
Know your subject
Question, Ask, Query, Demand
Plan, Test, Plan, Test
Thursday 20 May 2010

12. STARTING OUT - GOAL
Thursday 20 May 2010

13. STARTING OUT - RESEARCH
Research -> knowledge & understanding
Thursday 20 May 2010

14. STARTING OUT - SATISTICS
6.5 times more expensive to fix a flaw in
development than during design, 15 times more in
testing, and 100 times more in development.
Source http://2010survey.whitehatimperva.com/
Thursday 20 May 2010

15. STARTING OUT - INTERNAL SELL (1)
Technical issues in business language (e.g. just-in-
time patching)
and a bit of
Thursday 20 May 2010

16. STARTING OUT - INTERNAL SELL (2)
Know your costs
Advantages over cheaper alternatives!
Thursday 20 May 2010

17. STARTING OUT - INTERNAL SELL (4)
There is a disconnect between the
acknowledgement of security issues
and the willingness to fix them.
Source: The HP Security Laboratory Blog
Thursday 20 May 2010

18. STARTING OUT - INTERNAL SELL (4)
Do not oversell
WAF != unhackable
Thursday 20 May 2010

19. STARTING OUT - PLAN (1)
I love it when......
Copyright © NBC
Thursday 20 May 2010

20. STARTING OUT - PLAN (2)
WANTED!!!!
Owner/Champion/Lover
Thursday 20 May 2010

21. STARTING OUT - PLAN (3)
Thursday 20 May 2010

22. STARTING OUT - PLAN (4)
UAT & SDLC
Configuration - Delegation?
Alerting
Incident Response Plan
Logging & Analysis
Reporting
Thursday 20 May 2010

23. TEST - TEST
SOURCE: http://www.flickr.com/photos/
kodomut/
Thursday 20 May 2010

24. TEST - SDLC
How does it change?
When?
Who?
Thursday 20 May 2010

25. TEST - OPERATIONAL
Not what you want, is it?
Thursday 20 May 2010

26. TEST - FUNCTIONAL
Functional
Generic
Specific
SOURCE: http://www.flickr.com/photos/
54724780@N00/
Thursday 20 May 2010

27. TEST - STRESS
STRESS == LEARNING
SOURCE: http://www.flickr.com/photos/
54724780@N00/
Thursday 20 May 2010

28. TEST - THE FUN ‘BIT’
Does it work.......
SOURCE: http://nmap.org/movies.html
Copyright © Warner Bros.
Thursday 20 May 2010

29. TEST - POLICY
Administration Policy
Who has access?
Delegation?
Change Management - different?
Incident Response Plan?
What is an Incident?
Thursday 20 May 2010

30. IMPLEMENTATION - PLAN
Plan B?
Copyright © Fox
Thursday 20 May 2010

31. IMPLEMENTATION - ALMOST
Almost there, don’t cut corners!
COMPLETE TESTING FULLY!!!!!
Thursday 20 May 2010

32. IMPLEMENTATION - SET-UP
+.ve Security Model
Transparent
Informational Logging
Generic versus Specific
Analysis
Reporting
Thursday 20 May 2010

33. IMPLEMENTATION - READ
Check your logs!!!
Thursday 20 May 2010

34. IMPLEMENTATION - HACK
External Testing
Thursday 20 May 2010

35. IMPLEMENTATION
Transparent -> Blocking
Generic -> Specific
Thursday 20 May 2010

36. POST-IMPLEMENTATION - WAF
Your infrastructure has changed!!
Patching, Policy Changes, Application Upgrades
Thursday 20 May 2010

37. POST-IMP - STILL, OH YES?
SDLC
Network Firewall & ACLs
Code Analysis
Penetration &Vulnerability Testing
Incident Response Plan???? -> Incident? What?
Thursday 20 May 2010

38. POST-IMP - TICK TOCK, NO MORE!!
Thursday 20 May 2010

39. POST-IMP - USE IT!
NO!!!!!!
Thursday 20 May 2010

40. POST-IMPLEMENTATION - STILL?
As someone-else once said!!
Thursday 20 May 2010

41. RESOURCES
SANS Reading Room (Scareware via Web App
exploit)
SANS, Owasp, WebAppSec
Web 2.0 -> Blogs, Twitter
Vendor Sites
Thursday 20 May 2010

42. CONCLUSION - WAF
Extra layer of defence but also admin
Can be an excellent and effective solution
Is it what I need?
Only a part of defence-in-depth!!!!
Thursday 20 May 2010