Utilizing predefined signatures for inspecting private application access to mitigate zero-day common vulnerabilities and exposure (CVE)

1 . A method comprising:

responsive to security research identifying a zero-day Common Vulnerabilities and Exposure (CVE), receiving associated signatures of the zero-day CVE;

responsive to determining a user can access an application via a cloud-based system, wherein the application is in one of a public cloud, a private cloud, and an enterprise network, and wherein the user is remote over the Internet, obtaining an inspection profile for the user with the inspection profile including a plurality of rules;

performing inspection of transactions after the access using the plurality of rules including a rule for identifying the zero-day CVE, wherein the inspection utilizes one or more predefined signatures for identifying zero-day CVEs, wherein the signatures are continuously updated by the cloud-based system using behavioral analysis that applies at least one of (i) a blocking rule consistency check across transactions, and (ii) an accuracy level score determination for signature refinement, wherein the signatures are maintained as predefined inspection controls stored in rule database and included in the inspection profile as part of a security profile applied to the application; and

responsive to results of any of the plurality of rules, one or more of monitoring, allowing, blocking, and redirecting the access, via the cloud-based system, and further responsive to the results, dynamically propagating the updated signatures associated with the one or more predefined signatures within the cloud-based system to maintain consistency across inspection profiles, wherein the dynamically propagating comprises distributing updated rule definitions to a plurality of geographically distributed enforcement nodes of the cloud-based system responsive to a trigger generated upon a change in the rule database, and wherein updated rule definitions are incorporated into an output configuration file generated from a template that ordering and dependency tags among the plurality of rules.

2 . The method of claim 1 , wherein the plurality of rules include detection of any of top ten OWASP web application security risks supported by a WAAP.

3 . The method of claim 1 , wherein the plurality of rules include anomaly detection, bot detection, Application Programming Interface (API) inspection rules, Denial of Service (DoS) detection rules, and customizable rules.

4 . The method of claim 1 , further comprising:

generating fuzzy-logic based signatures based on the CVE; and

distributing the plurality of rules in a controlled opt-in framework, including the signatures, to one or more nodes of the cloud-based system for performing inspection based on the plurality of rules,

wherein a controlled opt-in framework is configured to deploy (i) signatures for new CVEs for which behavior is under active monitoring separately from (ii) signatures for past-confirmed CVEs, and wherein the distributing provides a virtual inline patch to mitigate exploitation of the CVE in customer environments.

5 . The method of claim 1 , wherein the plurality of rules are stored in a database with relational dependencies maintained therebetween, and wherein upon a violation of a first rule in an order, the access is blocked based thereon,

wherein maintaining the relational dependencies comprises storing individual rules as rows in the database, maintaining dependency tags in a template file separate from the individual rules, and at runtime generating a complete configuration file by replacing rule tags in the template file with rule text from the database and removing rule tags for rules having a disabled flag.

6 . The method of claim 1 , further comprising:

responsive to determining the user cannot access the application via the cloud-based system, notifying the user the application does not exist.

7 . The method of claim 1 , further comprising:

after the determining, stitching connections together between 1) the user and the cloud-based system and 2) the cloud-based system and the application.

8 . The method of claim 1 , further comprising:

logging results of the rules and the access in the cloud-based system.

9 . A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform steps of:

responsive to security research identifying a zero-day Common Vulnerabilities and Exposure (CVE), receiving associated signatures of the zero-day CVE;

responsive to determining a user can access an application via a cloud-based system, wherein the application is in one of a public cloud, a private cloud, and an enterprise network, and wherein the user is remote over the Internet, obtaining an inspection profile for the user with the inspection profile including a plurality of rules;

performing inspection of transactions after the access using the plurality of rules including a rule for identifying the zero-day CVE, wherein the inspection utilizes one or more predefined signatures for identifying zero-day CVEs, wherein the signatures are continuously updated by the cloud-based system using behavioral analysis that applies at least one of (i) a blocking rule consistency check across transactions, and (ii) an accuracy level score determination for signature refinement, wherein the signatures are maintained as predefined inspection controls stores in a rule database and included in the inspection profile as part of a security profile applied to the application; and

responsive to results of any of the plurality of rules, one or more of monitoring, allowing, blocking, and redirecting the access, via the cloud-based system, and further responsive to the results, dynamically propagating the updated signatures associated with the one or more predefined signatures withing the cloud-based system to maintain consistency across inspection profiles, wherein the dynamically propagating comprises distributing updated rule definitions to a plurality of geographically distributed enforcement nodes of the cloud-based system responsive to a trigger generated upon a change in the rule database, and wherein the updated rule definitions are incorporated into an output configuration file generated from a template that preserves ordering and dependency tags among the plurality of rules.

10 . The non-transitory computer-readable medium of claim 9 , wherein the plurality of rules include detection of any of top ten OWASP web application security risks.

11 . The non-transitory computer-readable medium of claim 9 , wherein the plurality of rules include anomaly detection, bot detection, Application Programming Interface (API) inspection rules, Denial of Service (DoS) detection rules, and customizable rules.

12 . The non-transitory computer-readable medium of claim 9 , wherein the steps further include:

generating fuzzy-logic based signatures based on the CVE; and

distributing the plurality of rules, including the signatures, to one or more nodes of the cloud-based system for performing inspection based on the plurality of rules,

wherein a controlled opt-in framework is configured to deploy (i) signatures for new CVEs for which behavior is under active monitoring separately from (ii) signatures for past-confirmed CVEs, and wherein the distributing provides a virtual inline patch to mitigate exploitation of the CVE in customer environments.

13 . The non-transitory computer-readable medium of claim 9 , wherein the plurality of rules are stored in a database with relational dependencies maintained therebetween, and wherein upon a violation of a first rule in an order, the access is blocked based thereon,

wherein maintaining the relational dependencies comprises storing dividual rules as rows in the database, maintaining dependency tags in a template file separate from the individual rules, and at runtime generating a complete configuration file by replacing rule tags in the template file with rule text from the database and removing rule tags for rules having a disabled flag.

14 . The non-transitory computer-readable medium of claim 9 , wherein the steps further include:

responsive to determining the user cannot access the application via the cloud-based system, notifying the user the application does not exist.

15 . The non-transitory computer-readable medium of claim 9 , wherein the steps further include:

after the determining, stitching connections together between 1) the user and the cloud-based system and 2) the cloud-based system and the application.

16 . The non-transitory computer-readable medium of claim 9 , wherein the steps further include:

logging results of the rules and the access in the cloud-based system.

17 . A cloud-based system comprising:

a plurality of nodes each having at least one processor and memory comprising instructions that, when executed, cause the at least one processor to

responsive to security research identifying a zero-day Common Vulnerabilities and Exposure (CVE), receive associated signatures of the zero-day CVE;

responsive to determining a user can access an application via a cloud-based system, wherein the application is in one of a public cloud, a private cloud, and an enterprise network, and wherein the user is remote over the Internet, obtain an inspection profile for the user with the inspection profile including a plurality of rules;

performing inspection of transactions after the access using the plurality of rules including a rule for identifying the zero-day CVE, wherein the inspection utilizes one or more predefined signatures for identifying zero-day CVEs, wherein the signatures are continuously updated by the cloud-based system using behavioral analysis that applies at least one of (i) a blocking rule consistency check across transactions, and (ii) an accuracy level score determination, wherein the signatures are maintained as predefined inspection controls stored in a rule database and included in the inspection profile as part of a security profile applied to the application; and

responsive to results of any of the plurality of rules, one or more of monitor, allow, block, and redirect the access, and further responsive to the results, dynamically propagating the updated signatures associated with the one or more predefined signatures within the cloud-based system to maintain consistency across inspection profiles, wherein the dynamically propagating comprises distributing updated rule definitions to a plurality of geographically distributed enforcement nodes of the cloud-based system responsive to a trigger generated upon a change in the rule database, and wherein the updated rule definitions are incorporated into an output configuration file generated from a template that preserves ordering and dependency tags among the plurality of rules.

18 . The cloud-based system of claim 17 , wherein the plurality of rules include detection of any of top ten OWASP web application security risks.

19 . The cloud-based system of claim 17 , wherein the plurality of rules include anomaly detection, bot detection, Application Programming Interface (API) inspection rules, Denial of Service (DoS) detection rules, and customizable rules.

20 . The cloud-based system of claim 17 , wherein the instructions that, when executed, cause the at least one processor to:

generate fuzzy-logic based signatures based on the CVE; and

distribute the plurality of rules, including the signatures, to one or more nodes of the cloud-based system for performing inspection based on the plurality of rules,

wherein a controlled opt-in framework is configured to deploy (i) signatures for new CVEs for which behavior is under active monitoring separately from (ii) signatures for past-confirmed CVEs, and wherein the distributing provides a virtual inline patch to mitigate exploitation of the CVE in customer environments.