Securing DOD Web Applications with a Scalable ... Securing DoD Web Applications Securing today¢â‚¬â„¢s complex

  • View
    0

  • Download
    0

Embed Size (px)

Text of Securing DOD Web Applications with a Scalable ... Securing DoD Web Applications Securing...

  • WHITE PAPER

    Securing DOD Web Applications with a Scalable Web Application Firewall Architecture

  • 2

    Introduction In the Department of Defense (DOD) dramatic growth of web applications, and the move to cloud technologies, has been accompanied by the rise of new security threats. Advanced persistent threats (APT) and insider threats are the two most acute security threats. These threats not only cause significant damage to national security, but also impact organizational momentum and have enormous cleanup costs. For example, the widely-publicized US Navy Iran APT incident impacted operations for over four months following a SQL injection attack, and required around $10m to clean up.1

    1 http://online.wsj.com/news/articles/SB10001424052702304732804579423611224344876

    When we consider the massive scale and breadth of DOD web applications, dealing with the web application- layer attack surface in an efficient, effective, and scalable manner is daunting. There is growing recognition within the DOD that better data and application security is required to adequately manage these new risks. DOD IT organizations also need to adapt to new challenges, such as:

    · Security of distributed applications across the DOD Information Network (DODIN)

    · Integration with cloud technologies · Extreme scale · Centralized control with delegated administration

    · Custom security policies for multiple applications with differing risk profiles

    · Variance in contractor secure coding practices

    · Rapidly changing threats and application attacks

    · Interworking with existing security architectures and policies

    With program offices under pressure to meet deadlines, operate on tighter budgets and deal with lowest priced technically acceptable (LPTA) acquisition policy the risk of application security vulnerabilities is very high.

    Software-based distributed web application firewalls are a game changing approach that arms DOD with the means to get ahead of these new, rapidly evolving risks.

    Securing DoD Web Applications Securing today’s complex mission- critical applications requires a combination of both network and host-based tools. Pulse Secure® Virtual Web App Firewall (Pulse Secure vWAF) has a distributed, three tier, massively scalable security capability, which can be deployed across the full range of hosting environments (physical, virtual and cloud). In addition, Pulse Secure offers virtual and cloud optimized licensing options that allow you to manage costs based on the volume of data protected (gigabits per second) rather than traditional per-instance or per-appliance licensing models. In high-security environments where server certificate sharing exposes an unacceptable risk, Pulse Secure vWAF can be installed as a plug-in on popular web server platforms, giving massive scalability for distributed applications. Designed for massive scalability, security policies can be managed centrally, while enforcement is distributed across your applications.

    Flexible Deployment Pulse Secure Virtual supports the full range of deployment options enabling you to choose the best fit for your architecture and application risk profile. Pulse Secure vWAF can be deployed physically on the web server, physically as a network appliance or virtually as a virtual appliance in a customer data center or cloud provider—or even as an integrated package with Pulse Secure Virtual Traffic Manager for enhanced security and control of complex applications.

    Policy Version History and Change Control Pulse Secure vWAF stores policies and change history in an integrated version control system, allowing roll- back to previous rulesets with just one click, making it easy to revert to known policy sets if a new ruleset interferes with an application.

    Dual Active Protect/ Detect Policies Continuous improvement and iteration of policies is made easy by running two active parallel rulesets: one ruleset runs in Protect mode for blocking malicious traffic and protecting your application; the other ruleset runs in Detect mode for evaluating new policies.

  • 3

    No Need to Store Copies of SSL Keys You can choose whether Pulse Secure vWAF manages your SSL termination: in a distributed architecture, it will not store copies of your SSL keys, and needs no changes to your PKI architecture, avoiding a potential target for man-in-the-middle attacks.

    Pure Software Form Factor Pulse Secure vWAF gives you the choice of either a virtual appliance or a pure software form factor. With true portability across clouds, and flexible integration with orchestration platforms, you can run on Windows and Linux systems, secure clouds, or traditional data centers.

    Powerful Scripting Engine The Python-based scripting engine allows your security professionals to change and secure every part of an application’s HTTP request/response flow. Complex flaws in applications like broken authentication models can be fixed inside Pulse Secure vWAF, without needing to change the application itself.

    Comprehensive User/ Rights Management Users and Groups can be assigned access rights to view or modify specific elements of the security configuration, so that policies can be restricted to closely-defined security groups.

    Start Small, But Scale to Meet Demand Pulse Secure vWAF can be scaled to meet transactions demands with a simple license key upgrade. Start small today, without over- provisioning, and then incrementally add more processing power and license keys as demand grows for transactions and throughput.

    Unmatched Scale and Performance Pulse Secure vWAF provides Layer 7 application security at massive scale and resilience for the largest applications, by allowing your security infrastructure to scale up and cluster out. And because the software can run on commodity compute servers and cloud platforms, you are not restricted to a fixed appliance form factor.

    Application Security—a Critical Component to Risk Management Every year, thousands of new vulnerabilities are reported in web applications, and it is clear that it is becoming a major challenge to keep pace with the growing threat. With so many new vulnerabilities reported each year, many organizations find it difficult to secure, maintain and enhance applications due to the complexities of security analysis and testing.

    Applications vendors themselves have a similar problem: not only do they need to remain alert to identify new vulnerabilities supported in their own

    applications; they need to determine whether custom integration projects might also compromise security of their own or other applications. Identifying and solving a security loophole can take significant time and resources in order to bring a patch or solution to market.

    While some application vulnerabilities can be solved quickly with a patch in a third-party component or OS module, it is not unusual for logic flaws or data leaks to take months to solve in production systems— leaving doors open for hackers to enter through. Some off-the-shelf applications can go unpatched for a year or more, depending on the priorities of the application vendors, and the perception of risk.

    Pulse Secure Virtual Web Application Firewall is a massively scalable solution for application-level security, both for off-the-shelf solutions, and complex custom applications including third-party frameworks. Pulse Secure vWAF can apply business rules to HTTP(S) traffic, inspecting and blocking attacks such as SQL injection and Cross-Site scripting,

    Figure 1: Defense in Depth: Pulse Secure Virtual Web Application Firewall provides multiple layers of protection.

  • 4

    while filtering outgoing traffic to mask personal identifiable information like social security numbers, and help maintain compliance with risk management frameworks such as NIST SP 800-53 rev 4, FedRAMP, DISA Security Technical Implementation Guides (STIG) and PCI-DSS.

    Cloud Applications are Exposed to a Wider Range of Threats Accessing cloud technologies requires a thin-client, typically a web browser, and security budgets have previously focused on network firewalls and antivirus solutions. However, more recently the primary target for attacks has shifted from the network layer to the application layer, because the operating systems and service interfaces available to cloud applications have been hardened to expose a reduced profile. As a result, it is now much easier to target the application logic or application framework than the actual server behind the hardened network perimeter. Most DOD applications are created in-house or by a contractor, but application security is rarely a core developer skill, which leads to a range of security problems throughout the application lifecycle.

    Furthermore, wider adoption of cloud computing means that attack vectors continue to increase, as applications leverage external hosting and delivering infrastructure, platform and software. It is increasingly common for web applications to be built on open- source components or prebuilt web frameworks. This approach has clear

    benefits of interoperability and shorter development time, but patching to solve security vulnerabilities becomes more complex. A flaw in one component of code must be patched for each instance it is used throughout each application in which it is used. In Platform-as-a-Service (PaaS) scenarios, with dynamic infrastructure and application frameworks, this can become very difficult to ma