‹#› Filling the security gap between network and application Praha November 2005 Ingmar Lüdemann Security Sales Manager Central & Eastern Europe This presentation provides a short overview of the F5 FirePass controller. ‹#› Agenda 1.Overview of making Applications >available< – >fast< – >secure< 2.What threats do we face? - general status web application security 3.Short Hacking demonstration 4.Easy explanation of Traffic Shield 5.How does Traffic Shield secure your applications? 6.Real Live examples 7.Summary This presentation provides a short overview of the F5 FirePass controller. ‹#› Agenda 1.Overview of making Applications >available< – >fast< – >secure< 2.What threats do we face? - general status web application security 3.Short Hacking demonstration 4.Easy explanation of Traffic Shield 5.How does Traffic Shield secure your applications? 6.Real Live examples 7.Summary This presentation provides a short overview of the F5 FirePass controller. ‹#› Agenda 1.Overview of making Applications >available< – >fast< – >secure< 2.What threats do we face? - general status web application security 3.Short Hacking demonstration 4.Easy explanation of Traffic Shield 5.How does Traffic Shield secure your applications? 6.Real Live examples 7.Summary This presentation provides a short overview of the F5 FirePass controller. ‹#› •“My advice is: Buy a Web application-specific firewall today and install it in front of all your Web servers as soon as you can.” •(Richard Stiennon, Gartner, 11/03) •“Application Firewalls are another hot project. Nearly 1/3 (32 percent) of interviewees have Application Firewall projects planned for next year [2004].” (TIP Research, 12/03) • Application Market Opportunity •“The Web application security market will be the hottest sector in Internet security. Enterprises will allocate budget for Web Application Gateway evaluations from IDS and firewall line items before officially budgeting for Web application gateways in 2004.” •(Eric Ogren, Yankee Group) • •“Hackers have fallen in love with application layer attacks, and with good reason. They are relatively easy to execute, and the opportunities are virtually unlimited. Web applications are fertile ground for hackers, and they control the direct connection to the underlying databases.” (Pete Lindstrom, Spire Security) Application Security Market (2002, 2007) Enterprise Spending (US $) 65% CAGR Sources: Yankee Group, Eric Ogren, in an interview with Network Magazine, June 21, 2003, Spire Security, Gartner, TIP ‹#› Enterprise Security’s Gaping Hole DATA “64% of the 10 million security incidents tracked targeted port 80.” Information Week ‹#› Requirements For Application Security Securing user AND transaction access to applications and data is critical to completely securing enterprise IT Partner Employee Customer Invalid Transaction From A Valid System Unauthorized User From A Valid Terminal Network Perimeter Security (Firewall, Virus Scan, IDS, etc.) Corporate Apps & Data Corporate IP Network arrow-bounce arrow-green User/transaction validity App & data access auth. ‹#› A Growing Problem •Sources: http://www.newsfactor.com/story.xhtml?story_id=34100, http://www.newsfactor.com/story.xhtml?story_id=33523 20% Increase in Vulnerabilities (Application Vulnerabilities, SANS) 36% Increase in Attacks (Successful Hacks and Defacements, Zone-H) 2,500 Web servers are successfully hacked each day out of the 45 million servers in existence. Note that this includes defacements ‹#› ‹#› Why do you need a Web Application Firewall (WAF)? •Previous Focus: network perimeter •perimeter security: legal or illegal Request? •“application layer left the internal applications, users and processes wide open” •Previous Client-Server Apps no go online •General Increase of web vulnerabilities •Enormous Time Pressure to go productiv •New Legal Conditions (personal data security, Basel II, sarbanes oxley…) • ‹#› Why Are Web Applications Vulnerable? •Even the most securely written code becomes insecure over time: •New type of attack not protected by current best practice methodology •New code written in a hurry due to business pressures •Code written by third parties; badly documented, poorly tested, third party not available •Flaws in third party infrastructure elements • • Time ‹#› Agile Applications •Improve: •Business continuity •Regulatory compliance •Business integrity •Information integrity •Protection from exponentially increasing threat • •. . . while at the same time deliver: •To market faster •More with less ‹#› What dangers do we face? ‹#› How can you secure your applications? •No single product ? •Layered approach: –Web application vulnerability assessment tool •Simulating Hacker Attacks •More effective as manual penetration tests •Check before Application is online –Code scanner •Check of source code •Tool for developer •=> AppScan (watchfire) –Web Application Firewall •Directly in Data flow to prevent attacks •Allows Content Inspection •Positive security model •Different methods of policy creation •Great help when using (negative) Patch Availability ‹#› Distinction to Web Services products •Web application security Produkte –Browser based applications – •Web Services Firewall –Focus auf server – to – server; basierend auf Web Services Standard –Extensible Markup Language (XML) –Simple Object Access Protocol (SOAP) – ÞTendency of cohalescence ÞAlready addressed (road map) ‹#› Excursion to: Risk Management see separate presentation This presentation provides a short overview of the F5 FirePass controller. ‹#› Application Security FirePass® Internet Web Servers ICAP AntiVirus – Virus filtering of file uploads – Filter email worms and virus Web application security – Cross-site scripting – Buffer overflow – SQL injection – Cookie management Email and File Access Security ‹#› Difference to other Security - Solutions networkfirewallicon networkfirewallicon networkfirewallicon Port- basierend Protokoll- basierend Applikations- basierend Firewall Intrusion Prevention Application Security Gateway Application Level Attacks Protocol Level Attacks DoS, etc. ‹#› Traditional Security Doesn’t Protect Web Applications ü ü ü ü ü ü ü ü ü ü ü ü ü ü Known Web Worms Unknown Web Worms Known Web Vulnerabilities Unknown Web Vulnerabilities Illegal Access to Web-server files Forceful Browsing File/Directory Enumerations Brute Force attacks Buffer Overflow Cross-Site Scripting SQL/OS Injection Cookie Poisoning Hidden-Field Manipulation Parameter Tampering Application Firewall X X X X X X X X X Network Firewall IPS X X X X X X ü Limited Limited Limited Limited Limited Limited Partial X Limited Limited Limited Limited Looking at the wrong thing in the wrong place These are the names of the attacks people generally refer to when they talk about Application Security. Note that it’s all just jargon; everyone has the same list and will claim that they can prevent it all. The real question is: HOW do they prevent it, and can they really prevent these things from happening in real life, in the ways that your applications are vulnerable to? Transition: Let me give you a specific example… ‹#› Jeder Nutzer einer Web-anwendung kann Sicherheits- lücken in der Anwendung ausnutzen, um auf Systeme hinter der Anwendung zuzugreifen. Da diese Attacken für die existierenden Sicherheits- Systeme wie gültige Browser-Anfragen aussehen, werden sie nicht erkannt APP 1 APP 2 DEEP INSPECTION FIREWALL Web Browser INTRUSION PREVENTION SYSTEM Ohne TrafficShield Application Security Gateway Companies are just now beginning to realize that all the information they have made available to users in a Web browser are open to hackers. •All existing security products let browser traffic through •Unlike client-server applications, browser applications let you “view source” and change what you’re asking for •…They can’t tell difference between “me asking for my information and me asking for your information” Transition: Let me give you a specific example… ‹#› Web Applications Increasingly Under Attack •High information density in the core •Flaws in applications & 3rd party software •Traditional security does not protect web apps. •Gaping hole in perimeter security for web traffic •Threat growing exponentially • •High value attack; AttackValue = Gain / Effort • • “My advice is: Buy a Web application-specific firewall today and install it in front of all your Web servers as soon as you can.” Gartner, November 2003 “Application Firewalls are another hot project. Nearly 1/3 (32 percent) of interviewees have Application Firewall projects planned for next year.” TIP Research, December 2003 ‹#› Agenda 1.Overview of making Applications >available< – >fast< – >secure< 2.What threats do we face? - general status web application security 3.Short Hacking demonstration 4.Easy explanation of Traffic Shield 5.How does Traffic Shield secure your applications? 6.Real Live examples 7.Summary This presentation provides a short overview of the F5 FirePass controller. ‹#› ‹#› http://auction.f5.com/ ‹#› http://auction.f5.com/includes/ ‹#› • ‹#› http://auction.f5.com/includes/config.inc.php ‹#› ‹#› http://auction.f5.com/includes/config.inc.php.old ‹#› • ‹#› ‹#› ‹#› • ‹#› • http://auction.f5.com/user_menu.php?nick=charlie ‹#› • http://auction.f5.com/user_menu.php?nick=* ‹#› ‹#› ‹#› ‹#› ‹#› ‹#› ‹#› ‹#› ‹#› ‹#› Your credit card XXXX XXX XXX 35008 will be charged US$1.00 ‹#› Agenda 1.Overview of making Applications >available< – >fast< – >secure< 2.What threats do we face? - general status web application security 3.Short Hacking demonstration 4.Easy explanation of Traffic Shield 5.How does Traffic Shield secure your applications? 6.Real Live examples 7. 7.Summary This presentation provides a short overview of the F5 FirePass controller. ‹#› Step One: The Browser “Companies are putting more and more information into web browsers.” ‹#› Step Two: The Connection “What they don’t realize is that these browers have direct access to customer data – or servers that access that data. If you can access your account data, you can access someone else’s.” ‹#› Step Three: Firewalls are Inadequate “All of this communication is over Ports 80 and 443 – which are wide open on Network Firewalls. They can’t tell the difference between me asking for my information and me asking for yours.” ‹#› Step Four: Introduce TrafficShield “TrafficShield terminates that web traffic, and makes sure it’s legitimate.” ‹#› Step Five: How Does it Work? “TrafficShield can tell if the request is legitimate because when it is installed, it creates a little map of the application, and checks to see if a given request is part of that map of legal requests.” ‹#› Step Five: How Does it Work? “This map can be as detailed as customers want: including object types, object names, parameters, and parameter values.” ‹#› Complete Picture Servers (and data) TrafficShield Network Firewall Browser ‹#› IF THEY ASK: Is This Different from IPS? IPS “IPS (often integrated into Network Firewalls) looks for attack signatures – useful for stopping known worms or script kiddies, but blind to a targeted attack.” ‹#› IF THEY ASK: How Does This Complement a Network Firewall? “It’s only looking at Web traffic, only for those applications. A web application firewall.” ‹#› Agenda 1.Overview of making Applications >available< – >fast< – >secure< 2.What threats do we face? - general status web application security 3.Short Hacking demonstration 4.Easy explanation of Traffic Shield 5.How does Traffic Shield secure your applications? 6.Real Live examples 7.Summary This presentation provides a short overview of the F5 FirePass controller. ‹#› Web (!) Application Security with TrafficShield ‹#› Intelligent Infrastructure VPN App Firewall App User Traffic Mgt Intelligent Client Network Plumbing Application Infrastructure Application VALID BEHAVIOUR ONLY Positive Security ATTACKS Negative Security EXPOSURES Negative Security: •Exponential threat •Exposure Window •No ‘Zero Day” Protection Positive Security: •Growth bound by application size •Exposure Protection •‘Zero Day” Protection Firewall IDS-IPS Anti-Virus Customers have demanded that we increase the types of things that we do to traffic. What Every Enterprise is asking How do I make my applications run better without rewriting them, or incurring major infrastructure cost and adding significant management overhead? “I need to be as optimized as I can be with minimal resource impacts and as simply as possible.” -Ken Langston, Director of Infrastructure, ‹#› Application Security Placement VPN App Firewall App User Traffic Mgt Intelligent Client Network Plumbing Application Infrastructure Application Firewall IDS-IPS Anti-Virus Customers have demanded that we increase the types of things that we do to traffic. What Every Enterprise is asking How do I make my applications run better without rewriting them, or incurring major infrastructure cost and adding significant management overhead? “I need to be as optimized as I can be with minimal resource impacts and as simply as possible.” -Ken Langston, Director of Infrastructure, ‹#› Horizontal brick Application Security Methodology •Policy-based proxy •Appliance form-factor •Stops generalised & targeted attacks •Application content & context aware •Bi-directional; content scrubbing & application cloaking VPN App Firewall App User Traffic Mgt Intelligent Client Network Plumbing Application Infrastructure Application Firewall IDS-IDP Anti-Virus Buffer Overflow Cross-Site Scripting SQL/OS Injection Cookie Poisoning Hidden-Field Manipulation Parameter Tampering Error Messages Non-compliant Content Fingerprints Customers have demanded that we increase the types of things that we do to traffic. What Every Enterprise is asking How do I make my applications run better without rewriting them, or incurring major infrastructure cost and adding significant management overhead? “I need to be as optimized as I can be with minimal resource impacts and as simply as possible.” -Ken Langston, Director of Infrastructure, ‹#› Application Security with TrafficShield Horizontal brick Horizontal brick PORT 80 PORT 443 Attacks Now Look To Exploit Application Vulnerabilities Perimeter Security Is Strong Buffer Overflow Cross-Site Scripting SQL/OS Injection Cookie Poisoning Hidden-Field Manipulation Parameter Tampering ! Infrastructural Intelligence ! Non-compliant Information High Information Density = High Value Attack ! Forced Access to Information But Is Open to Web Traffic ‹#› ! Non-compliant Information ts Application Security with TrafficShield ! Unauthorised Access ! Infrastructural Intelligence •Bi-directional: –Inbound: protection from generalised & targeted attacks –Outbound: content scrubbing & application cloaking •Application content & context aware •High performance, low latency, high availability, high security TrafficShield Allows Legitimate Requests And Stops Bad Requests ! Unauthorised Access ‹#› ts Horizontal brick Application Security with TrafficShield Horizontal brick Intelligent Decisions Allow Only Good Application Behaviour; Positive Security Definition of Good and Bad Behaviour ‹#› Single Unit Deployment internet server server server firewall Firewall ts TrafficShield Web Servers desktop_pc Management Access (browser) bigip LB Switch ‹#› TrafficShield Topology - Standard internet firewall server ts ts standby ts active firewall web server ‹#› server server server ts TrafficShield Web Servers Active ts Backup Redundant Deployment firewall Firewall internet desktop_pc Management Access (browser) bigip LB Switch ‹#› server server server bigip ts ts ts bigip TrafficShield Web Servers LB Switch LB Switch Load Balanced Deployment firewall Firewall internet desktop_pc Management Access (browser) ‹#› TrafficShield Deployment •Installed in-line to existing web servers • •Point DNS to TrafficShield service IP address • •Have fall-back method to switch traffic to servers in event of failure ts 2_racks_trans 2_racks_trans 2_racks_trans ‹#› Transparent Proxy Browser Server TrafficShield Private Network Browser Server Service-IP desktop_pc 2_racks_trans 2_racks_trans desktop_pc Service-IP ts •Typically TrafficShield takes WEB server service IP and serves users using this IP. •TrafficShield communicates with WEB server using private addresses (this makes direct access from external address to WEB service impossible). •Application session termination. •Browser is not aware that TrafficShield exists. ‹#› Browser Server 2_racks_trans desktop_pc ts Enforcement TrafficShield Security Policy Application Cloaking How TrafficShield Policies Work •Typically TrafficShield takes WEB server service IP and serves users using this IP. •TrafficShield communicates with WEB server using private addresses (this makes direct access from external address to WEB service impossible). •Application session termination. •Browser is not aware that TrafficShield exists. ‹#› TrafficShield (passive/active) CRAWLER ‘Maps’ the App. (APC only) Live Data Operator Implements policy updates Security Policy Building a Security Policy LEARNING Recommends policy updates based on traffic ‹#› Positive Security ‹#› Actions not known to be legal can now be blocked - Wrong page order - Invalid parameter - Invalid value - etc.