A Network Administrator s Guide to Web App Security

A Network Administrator s Guide to Web App Security Speaker: Orion Cassetto, Product Marketing Manager, Incapsula Moderator: Rich Nass, OpenSystems Media

Agenda Housekeeping Presentation Questions and Answers Wrap-up

A Network Administrator s Guide to Web App Security Presented by: Orion Cassetto, Sr. Product Marketing Manager, Incapsula

Incapsula Webinar Thanks for joining! The webinar is about 30 minutes long Questions will be answered during and after the session Please submit your questions using the chat window 4

Speaker Bio Orion Cassetto Sr. Product Marketing Manager for Incapsula Previously held product marketing positions at Imperva and Armorize Technologies Experienced in Web app security, and SaaS security solutions Holds degrees in Asian Studies, and Chinese Language from Washington State University 5

Overview Recent web security events Web Applications Threats and Common Attack Types How to defend your website against Today s common Threats Automated tools to secure to help you simplify website security 6

Major Hacks of 2014 2014 has several enormous data breaches from hackers including:

Heartbleed the Epic SSL Crisis of 2014 Heartbleed is a security bug that was disclosed in April of 2014 It was present in the widely used Open SSL Cryptography When disclosed, around 17% of the Internet's secure web servers was vulnerable Why do I care? > The vulnerability allowed for the theft of the servers' private keys and users' session cookies and passwords Some might argue that [Heartbleed] is the worst vulnerability found since commercial traffic began to flow on the Internet. Joseph Steinberg Forbes 8

Shellshock Vulnerability What is it? 1. Shellshock is a vulnerability that affects Bash (a.k.a Bourne-again Shell), the most common command-line shell on Linux / Unix / Mac OS systems 2. Allows unauthenticated attacks to remotely execute code on affected machines What damage could this cause your website? Hackers remotely executing code on your systems can result in > Data theft > Malware injection > Server hijacking 9

Distributed Denial Of Service (DDoS) Attacks DDoS attack are attacks where many infected computers band together to attack a single target These attacks exhaust network connections and server resources causing website outages 10

Use of Stolen Credentials Reigns Supreme Use of stolen authentication credentials by hackers is the number one threat of 2013 Once stolen hackers can use credentials at other websites to increase the impact of a breach Automated tools combined with stolen password lists become a dangerous combination Sources: Verizon Data Breach Report 2014 12

Websites Have Many Vulnerabilities 96% of web applications have vulnerabilities 96 % WEB APP 13 % 13% of websites can be compromised automatically Sources: Cenzic, Inc. Feb. 2014, Incapsula, Inc. 2013

SQL Injection What it is and why it matters What is SQL Injection? > SQL Injection attacks attempt to use application code to access or corrupt database content > It is accomplished by embedding SQL statements in user supplied Data > Example: What happens if a hacker exploits this vulnerability? > They can access your database and it s data. Basic Rule 'OR = > If it is going into your database, clean it up first! The application was expecting my name, but I entered an SQL Statement 14

Cross Site Scripting (XSS) What it is and why it matters What is XSS? > A type of attack in which hackers inject scripts (like JavaScript) into otherwise trusted websites What happens if a hacker exploits an XSS vuln on my website? > Stolen cookies or sessions > Redirection to a malicious page Basic Rule > If user supplied data is going into your application, clean it up first! 1 3 Attacker gains control over user data or system via injected exploit Attacker inserts malicious unfiltered code into an application 2 User visits the web page and malicious code is returned with the web page 15

How DDoS Attacks Bring Down Websites DDoS attacks make your website completely inaccessible DDoS Traffic Legitimate Traffic Your ISP Your Internet Connection Your Site If website availability is important to you, then DDoS protection should be too Any application without a DDoS mitigation strategy is at risk 16

Automated Clients are the Majority of Web Traffic Over 61% of all website traffic is non-human. 61.5% Non-Human Traffic 1/2 of that is malicious. 38.5% Human Traffic 17

The Impact of Bots on Website Security Good Bots Search Engine Crawling Website Health Monitoring Vulnerability Scanning Bad Bots DDoS Site Scraping Comment Spam SEO Spam Fraud Vulnerability scanning 18

Use Multi-factor Authentication for Admin Areas Problem Lost or stolen passwords allow hackers to bypass your security measure Solution Secure Admin areas with multi-factor authentication > Email > SMS > Google Authenticator > Other 20

Identify Vulnerabilities White-box and Black-box tools Can you see inside the application (its code)? 21

The White-box Approach The white-box approach to finding vulnerabilities is to Review Application Code for vulnerabilities. Can be performed: Manually or Automatically Manual Code Review Source Code Analysis 22

The White-box Approach The Black-box approach to finding vulnerabilities is to Emulate Hacker Activity by probing a website for weaknesses. Can be performed: Manually or Automatically Penetration Testing Web Vulnerability Scanning 23

Remediating Vulnerabilities at a Code Level Manual White-box Manual Code Review Black-box Penetration Testing List of Automated Source Code Analysis Web Vulnerability Scanner Vulnerabilities Known vulnerabilities should be remediated What are the requirements for fixing vulnerabilities at the code level? > Access to application code > Coding expertise and knowledge in Security 24

Use a Web Application Firewall (WAF) WAFs provide similar protection as traditional network layer firewall but for a web application Using a WAF can protect website from application layer hacking attempts WAFs should be used in conjunction with traditional firewalls 25

Defend against DDoS attacks DDoS mitigation services are preferable to Mitigation Appliances Overprovisioning bandwidth is expensive DDoS Traffic DDoS Mitigation Appliance Legitimate Traffic Your Internet Connection Your ISP Your Site 26

DDoS Mitigation Requires Specialized Tools or Services DDoS mitigation services are preferable to Mitigation Appliances Overprovisioning bandwidth is expensive DDoS attacks should be mitigated close to their source (away from your network) DDoS Traffic Legitimate Traffic DDoS Mitigation Service Your Internet Connection Your ISP Your Site 27

Identify and Block Bad Bots Implement a solution which can block bad bots to prevent > Comment Spam > Site Scraping > Vulnerability Scanning > Automated SEO Poisoning Bot Mitigation can be > Standalone service or appliance > Part of other tools like a WAF 28

When To Implement Various Security Tools PLANNING Security Requirements Design Architecture CODING Source Code Analysis Manual Code Review Password Security 2 Factor Authentication PRODUCTION Web App Firewall DDoS Mitigation Bot Mitigation Web Vulnerability Scanner 29

Finding the Right Tools WAF Web Vulnerability Scanner DDoS Mitigation Commercial Incapsula Imperva F5 Whitehat Security Nessus Acunetix Incapsula Prolexic Neustar Open Source / Free Mod Security Nikto Wapiti Qualys Not available / Not advised Source Code Analysis Fortify IBM Appscan Parasoft FindSecurityBugs 30

Website Security and Performance in Minutes with a Simple DNS Change By routing website traffic through the Incapsula network, malicious traffic is blocked, and legitimate traffic is accelerated. Legitimate Traffic Incapsula Network Your Website For a Free Trial of Incapsula visit us at www.incapsula.com 31

Thank you Please send follow up questions to info@incapsula.com

Orion Cassetto, Product Marketing Manager, Incapsula Audience Q & A

Thanks for joining us Event archive available at: http://ecast.opensystemsmedia.com/ E-mail us at: clong@opensystemsmedia.com