Building Your Own WAF as a Service and Forgetting about False - - PowerPoint PPT Presentation

▶
building your own waf as a service and forgetting about
SMART_READER_LITE
LIVE PREVIEW

Building Your Own WAF as a Service and Forgetting about False - - PowerPoint PPT Presentation

Mar 24, 2024 104 likes •700 views

Building Your Own WAF as a Service and Forgetting about False Positives 1 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner Juan Berner @89berner Lead security developer @Booking.com Blog:

slide-1
SLIDE 1

Building Your Own WAF as a Service and Forgetting about False Positives

1 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-2
SLIDE 2

Juan Berner

@89berner

Lead security developer @Booking.com

2 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

Blog: medium.com/@89berner

slide-3
SLIDE 3

Overview

  • Introduction to WAF & deployment modes
  • WAF as a service
  • Blocking attacks without false positives or

increased latency

  • Demo

3 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-4
SLIDE 4

WAF?

  • Web Application Firewall
  • Mainly used to protect against Application Attacks
  • SQLi, RCE, Protocol Violations, Rate Limiting ...

4 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-5
SLIDE 5

Deployment mode - Inline

  • Pros:

○ Traffic inspection ○ Ability to block ○ Transparent for web servers

  • Cons:

○ Network placement ○ Latency

5 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-6
SLIDE 6

Deployment mode - Out of band

  • Pros:

○ Traffic inspection ○ Transparent for web servers ○ Simpler network placement

  • Cons:

○ Can’t block attacks ○ PFS

6 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-7
SLIDE 7

Deployment mode - Agent

  • Pros:

○ Easier network placement ○ Simple to scale

  • Cons:

○ More invasive on deployment environment ○ Can be less efficient on resource allocation

7 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-8
SLIDE 8

Deployment mode - Cloud

  • Pros:

○ Simple to setup and scale ○ Network effect

  • Cons:

○ Out of your control ○ Latency added

8 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-9
SLIDE 9

Caveats with typical WAF Solutions

  • Network placement
  • Availability and performance concerns
  • False positive rate
  • Lack of control from developers

9 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-10
SLIDE 10

Building the WAF as a Service

  • Removes FP by having an understanding of the

application context

  • No need for an appliance, just add an API call
  • Blocking behaviour is decided by the application
  • Ability to avoid latency for regular users

10 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-11
SLIDE 11

How could you build one?

  • Open source components already exist
  • Creating a log processing pipeline
  • Building a WAF API
  • Library for logs and calling API

11 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-12
SLIDE 12

Case study: Web application

  • Setup in Google Cloud
  • Flask microframework
  • Code available in github

12 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-13
SLIDE 13

Finding a middle ground

  • Out of band mode removes concerns of latency

added to users

  • Inline mode provides security by blocking attacks
  • Could we get the best of both worlds?

13 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-14
SLIDE 14

Components - Web application

14 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-15
SLIDE 15

Components - Web application

  • Can decide which mode to work on

○ Inline ○ Out of band

  • Sends logs with partial request data encrypted

Example: Flask

15 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-16
SLIDE 16

Components - Agent

  • Acts as a reverse proxy
  • Minimal footprint
  • Application agnostic
  • Can get settings from the application

16 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-17
SLIDE 17

Components - Library

  • Simple to implement
  • Inherent risks
  • Strategy for this talk

17 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-18
SLIDE 18

Components - WAF service

18 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-19
SLIDE 19

Components - WAF service

  • Pluggable architecture
  • Parallel nature of their components
  • Applications can decide how to react

19 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-20
SLIDE 20

Components - WAF service

  • Open source components

○ Modsecurity ○ Naxsi

20 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-21
SLIDE 21

Components - WAF service

  • Proprietary software or appliances

○ Reduced complexity of installation ○ Simple way of evaluation

21 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-22
SLIDE 22

Components - WAF service

  • Custom modules

○ Apply custom business logic ○ Implement simple services ■ Rate limiting ■ Rule engine for blocking ○ ML models

22 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-23
SLIDE 23

WAF service

23 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-24
SLIDE 24

Components - Log processing

24 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-25
SLIDE 25

Components - Log processing

  • Replays logs that were not in line against WAF
  • Calculates scores through windows of time

25 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

Google Dataflow

slide-26
SLIDE 26

Components - Detection

26 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-27
SLIDE 27

Components - Detection

  • Triggered by Log Processing
  • Business value
  • Patterns of behaviour for FP

27 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-28
SLIDE 28

Components - State store

28 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-29
SLIDE 29

Components - State store

  • Allows to store configuration
  • Ideally fast lookup for caching

29 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-30
SLIDE 30

Components - Visualisation

30 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-31
SLIDE 31

Components - Visualisation

  • Easily understand activity
  • Visibility on attacks
  • Performance metrics

Example: ELK

31 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-32
SLIDE 32

Components - Visualisation

32 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-33
SLIDE 33

Components - Visualisation

33 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-34
SLIDE 34

Components - Management

34 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-35
SLIDE 35

How to block?

  • Detection decides when to send traffic to the WAF
  • Can also be triggered manually

35 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-36
SLIDE 36

Traffic routing

  • Fingerprint based routing

○ Blocks based on scores ○ IP, client_id, combinations, 0day signatures .. ○ Added automatically or manually

36 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-37
SLIDE 37

Traffic routing

  • Net block based routing

○ ISP ○ Hosting providers ○ Tor exit nodes / Proxies

37 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-38
SLIDE 38

Traffic routing

  • Virtual Patching

○ Always route particular vulnerable endpoints ○ Select for combination of parameters if needed ○ Example: website.com/?vuln_param=

38 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-39
SLIDE 39

FP rate management

  • Detection FP vs blocking FP
  • Key to allow blocking without impacting users
  • Acceptable rate might change per application
  • Tuning can become unbearable in highly changing

applications

39 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-40
SLIDE 40

FP rate management

  • Business logic

○ How trustworthy is a user/ip? ○ Key business activity ○ What would be the impact on blocking them

40 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-41
SLIDE 41

FP rate management

  • Historical Analysis

○ How normal is this type of request for this endpoint? ○ How does this user compare with others ○ How common are detection FP in this endpoint

41 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-42
SLIDE 42

FP rate management

  • Context analysis

○ How many times have they triggered a FP ○ How many requests have they sent

42 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-43
SLIDE 43

FP rate management

  • Example: Sleep(

○ message=“I will sleep(1 or 2 days)” ■ Might be detected as SQLI ■ Probability of FP is independent from each

  • ther

43 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-44
SLIDE 44

FP rate management

  • Independant SQLI FP rate: 0.1%
  • Our aim, 0.00001% (0.01^5)
  • Score needed => 5 * Reputation Score
  • Aimed at attacks that need volume

44 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-45
SLIDE 45

Hybrid mode

  • Benefits

○ WAF does not add latency for good users ○ Flexibility ○ Removes FP’s

45 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-46
SLIDE 46

Hybrid mode

  • Caveats

○ Delayed response time for blocking when using identifier mode ○ Increased complexity

46 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-47
SLIDE 47

47 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-48
SLIDE 48

Request lifetime - Initial request

48 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

1

slide-49
SLIDE 49

Request lifetime - Cache check

49 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

2

slide-50
SLIDE 50

Request lifetime - Request encapsulation

50 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

3

slide-51
SLIDE 51

Request lifetime - Out of band processing

51 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

4

slide-52
SLIDE 52

Request lifetime - Attack detection

52 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

5

slide-53
SLIDE 53

Request lifetime - Additional requests

53 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

6

slide-54
SLIDE 54

Request lifetime - Cache update

54 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

7

slide-55
SLIDE 55

Request lifetime - Inline behaviour

55 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

8

slide-56
SLIDE 56

Summary (1/2)

  • Reduced customer impact

○ Use hybrid mode to only add latency to malicious actors ○ Stops false positives from affecting customers through understanding history, context and business metrics ○ Specify different behaviour based on endpoint’s risk

56 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-57
SLIDE 57

Summary (2/2)

  • Flexibility

○ Extensible through third party products or custom plugins ○ Allows developers to integrate through api calls where needed

57 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner

slide-58
SLIDE 58

What now?

  • Try it!
  • https://github.com/89berner/waf-api-talk
  • git clone https://github.com/89berner/waf-api-talk

&& cd waf-api-talk; ./setup $YOUR_GCP_PROJECT

  • Questions?

58 Building Your Own WAF as a Service and Forgetting about False Positives Juan Berner