Necessity of web application firewall on internet

Increasing digitalisation: the ongoing digitalisation of the business world and the growing spread of web applications and cloud-based services have led to more and more sensitive data being stored online. This has attracted cybercriminals looking for ways to steal or misuse this data.

1. Weak security measures: many companies neglect security of their web applications and don't invest enough resources in developing and implementing robust security measures. This makes it easier for cybercriminals to exploit vulnerabilities in applications and gain access to confidential information.

2. Complexity of web applications: Modern web applications are highly complex and comprise a wide range of components that interact with one another. This makes it more difficult to identify and secure all possible attack vectors.

3. Automated attacks: cybercriminals increasingly use automated tools such as bots and scripts to find and exploit vulnerabilities in web applications. These attacks can be very fast and effective, making them harder to detect and defend against.

4. Mobile devices: the spread of mobile devices and the increase in the use of mobile applications has meant that more and more data is accessed via web applications on mobile devices. This has prompted cybercriminals to extend their attacks to mobile applications and web applications.

Damage potential

The potential damage of an attack on a web application can vary greatly and depends on various factors, such as:

• Type and scope of the attack: A successful attack can result in confidential data, e.g. from your e-commerce system, being stolen, manipulated or deleted. It can also disrupt operations or impair the availability of the application.

• Type of data affected: the damage also depends on what type of data is affected. If it involves personally identifiable information (PII) such as names and addresses, the damage can be considerable, since the stolen data can be used for identity theft or fraud.

• Size and type of company: the damage also depends on how large the company is and what kind of business it operates. A small company may not have as many resources to recover from an attack, while a larger company may have multiple locations, servers and data centres, all of which could be affected.

• Duration of the attack: the damage also depends on how long the attack remains undetected and how quickly the company can react to stop the attack and restore the affected systems.

Overall, the potential damage from an attack on a web application can be very high, both financially and in terms of loss of reputation, trust and customers. It's difficult to precisely estimate the potential financial damage of an attack on a web application, as it depends on too many factors. According to a study by Verizon, however, this averages at EUR 19,736, with 95% of incidents falling between EUR 751 and EUR 594,764.

Open Web Application Security Project (OWASP)

OWASP is committed to efficient protection. It stands for "Open Web Application Security Project" and is a non-profit organisation dedicated to improving the security of web applications. The organisation provides a wealth of information, resources and tools to support developers, security experts and interested parties in building and maintaining secure web applications.

The current OWASP Top 10 list is a compilation of the most common vulnerabilities in web applications. Here's a brief explanation of each of the top 10 rules:

1. Injection attacks: injection attacks occur when malicious data is introduced into a web application to manipulate it or access confidential information.

2. Broken authentication and session management: this refers to vulnerabilities in authentication and session management that allow attackers to impersonate other users or access confidential information.

3. Cross-Site Scripting (XSS): XSS attacks occur when malicious code is injected into a web application to manipulate users or steal confidential information.

4. Secure configuration: vulnerabilities in access control can allow users to access information or perform functions for which they don't have authorisation.

5. Security-relevant misconfigurations: poor configuration of security settings can make it easier for attackers to penetrate a web application or steal information.

6. Insecure Cryptographic Storage: Insecure storage of passwords, keys or other sensitive information can mean they're easily accessible.

7. Insufficient Transport Layer Protection: inadequate encryption and protection of data during transmission can result in information being stolen or manipulated in transit.

8. Unvalidated Input: Unvalidated input can allow attackers to inject malicious data into a web application in order to manipulate it or access confidential information.

9. Insufficient logging and monitoring: a lack of logging and monitoring can make it difficult to detect and respond to attacks.

10. Using Components with Known Vulnerabilities: using components with known vulnerabilities can allow attackers to easily gain access to a web application or manipulate it.

Facts and figures: how important is it really?

For better assessment, we analysed the web application firewall we use for our clients over a one-month period and found that, on average, every 200th request represents a successfully repelled attack attempt. Furthermore, attackers are currently concentrating on the following 3 of the rulesets mentioned above:

• Method enforcement

• Scanner detection

• Protocol enforcement

Our measurement results in the following distribution:

For efficient protection, vulnerabilities should be adjusted and regularly reviewed: vulnerabilities can be addressed by adapting the software or its processes, or by installing a Web Application Firewall:

Software and process adaptation:

• Prevent injection attacks: check all inputs accepted from users to ensure they can't be misused as part of a database or code injection.

• Broken authentication and session management: use strong passwords, enforce password policies and implement secure session management by protecting sessions with strong encryption and a sensible expiry time.

• Prevent cross-site scripting (XSS): validate all inputs accepted from users to ensure they contain no malicious scripts.

• Secure configuration: make sure all servers and applications are securely configured and that all known vulnerabilities have been fixed with patches or updates.

• Insufficient access control: implement strong access control and make sure users can only access the functions and data they need.

• Security-relevant misconfigurations: make sure all components of your application and servers are securely configured and that all default passwords or settings have been changed.

• Missing function or permission check: implement a check of user permissions before allowing actions on the application.

• Preventing cross-site request forgery (CSRF): Use CSRF tokens to ensure that only authorised users can perform actions within your application.

• Use of insecure components: Only use trustworthy and up-to-date components for your application.

• Insufficient logging and monitoring: Implement a logging and monitoring system to detect suspicious activity in your application.

Web Application Firewall

An active web application firewall can monitor and close open security gaps in an application. It sits in front of e-commerce platform and filters malicious traffic before it can get through. One of the market leaders here, for example, is Cloudflare. If you need this, our Managed Cloudflare can support you with installation and operation.

Alternatives to this, per Gartner, are Akamai, Imperva, Fastly or AWS WAF:

It's important to note that there are many other WAF providers, and choosing the most suitable provider depends on the individual requirements and needs of the company.

It's also important that you stay up to date on the latest OWASP Top 10 vulnerabilities and regularly test your application to ensure it's secure. These can be achieved, for example, through integrated CVE monitoring and regularly run security scans.

CVE monitoring

CVE monitoring is an integration of vulnerability validation into the development cycle. For this, trivy can be used, for example. 

Trivy is an open-source security scanner developed specifically for the security assessment of container images. Trivy can scan container images for vulnerabilities, missing patches and configuration errors by using a wide range of data sources, including public CVE databases, OS package managers and security benchmarks. The tool can be integrated into various continuous integration/continuous delivery (CI/CD) pipelines to enable automated security assessment of container images. Trivy is able to scan container images for a wide range of operating systems and frameworks, including Alpine Linux, CentOS, Debian, Ubuntu, Node.js, Ruby, Python and many others. The tool can also be used as part of a broader security and compliance programme to ensure that container images meet internal security policies and external compliance requirements.

Alternatively, the following tools can also be used for security assessment of container images:

• Clair: Clair is an open-source security scanner developed specifically for checking vulnerabilities in Docker containers. It can scan container images for vulnerabilities, CVEs and other security threats.

• Anchore: Anchore is cloud-based platform built to ensure security of container images. It can scan container images for vulnerabilities, missing patches and configuration errors, and run risk assessment.

• Docker Bench for Security: Docker Bench for Security is an open-source tool specifically developed to assess the security of Docker containers. It can run a wide range of tests to ensure compliance with best practices and security guidelines.

• Sysdig Secure: Sysdig Secure is a cloud-based security tool developed for security assessment of container images. It can scan container images for vulnerabilities, CVEs and other security threats and carry out a risk assessment.

Security Scans

Finally, a regular review of vulnerabilities should be carried out to validate the current status quo. This offers a relatively simple way to identify security gaps that could be exploited by attackers, in the form of automated tests, classified according to the OWASP Top 10:

The blackbox scans offer a comprehensive analysis, deep scanning and malware detection:

• Comprehensive analysis

The Web Application Scan finds and catalogues all web apps on your network, including new and unknown ones. We can tag your applications with their own labels and then use these labels to control reporting and restrict access to scan data.

• Deep Scanning

The dynamic deep scanning of Web Application Scan covers all apps and APIs across your perimeter, internal networks and public cloud instances, giving you instant visibility of vulnerabilities such as SQLi and XSS. Authenticated, complex and progressive scans are supported. With programmatic scanning of SOAP and REST API services, IoT services and mobile app backends can be validated.

• Malware detection

The Web Application Scan scans and identifies your organisation's websites. It warns you of infections, including zero-day threats, through behavioural analysis. Detailed malware infection reports accompany the infected code for remediation.

You can use, for example, Qualys with its "Web Application Scan" for this. https://www.qualys.com/apps/web-app-scanning/

Conclusion

Overall, it's important that companies take the threat of attacks on web applications seriously and take appropriate security measures to protect your applications. We've mentioned various ways you can operate your web application more securely. We'd be happy to subject your application to a security audit and provide you with individual recommendations for action. Get in touch!

https://synaigy.com/details/security-audit

Sources:

Verizon study: Data Breach Investigations Report - Executive Summary

• https://www.verizon.com/business/resources/reports/2020-dbir-executive-brief.pdfx

• https://www.verizon.com/business/resources/reports/2021-dbir-executive-brief.pdfx