Real time application protection system configuration drift categorization and response
Techniques are described for improving real-time application protection (RTAP) systems (e.g., web application firewalls (WAFs), runtime application self-protection (RASP) systems). In particular, a device within a trusted network may monitor or test the configuration settings of the RTAP systems, network traffic into the RTAP systems, and/or log information from the RTAP systems. For example, the device may detect drift in a configuration for a particular RTAP system by comparing the configuration settings of the RTAP systems to baseline configuration settings and classifying any detected drift as good drift or bad drift. In some examples, the device may maintain the configuration settings or set the configuration settings as the baseline configuration settings when the configurations settings include good drift from the baseline configuration settings. In other examples, the device may set the configuration settings with the bad drift to the baseline configuration settings.
1 . A computer-implemented method comprising:
detecting a difference between first configuration settings of an application protection system corresponding to a first application and baseline configuration settings of the application protection system, wherein the baseline configuration settings include protections against a first plurality of attacks;
in response to detecting the difference:
analyzing one or more logs corresponding to the first application to determine whether the first configuration settings protect against at least the first plurality of attacks, and
determining whether the difference comprises good drift or bad drift, wherein the difference comprises good drift if the one or more logs include indications that known potential attacks included in at least the first plurality of attacks are detected, blocked, or reported by the application protection system corresponding to the first application and wherein the difference comprises bad drift if the one or more logs include indications that the known potential attacks included in at least the first plurality of attacks failed to be detected, blocked, or reported by the application protection system corresponding to the first application; and
in accordance with a determination that the difference comprises good drift, maintaining the first configuration settings for the application protection system.
2 . The method of claim 1 , further comprising, in accordance with the determination that the difference comprises good drift, updating the baseline configuration settings to the first configuration settings, wherein the first configuration settings include protections against an additional attack that is not included in the baseline configuration settings.
3 . The method of claim 1 , further comprising, in accordance with the determination that the difference comprises good drift, updating second configuration settings of a second application protection system corresponding to a second application within a same network as the first application to be substantially similar to the first configuration settings.
4 . The method of claim 1 , wherein the first configuration settings disable a first rule corresponding to a respective attack, and wherein analyzing the one or more logs comprises analyzing the one or more logs corresponding to the first application to determine whether the first configuration settings include one or more second rules that provide protection against at least the respective attack.
5 . The method of claim 1 , wherein the first configuration settings disable a first rule corresponding to a respective attack, and wherein analyzing the one or more logs further comprises:
identifying an attack payload corresponding to the respective attack in the one or more logs corresponding to the first application, wherein the application protection system blocked the respective attack for the first application when the application protection system had the baseline configuration settings; and
determining whether the application protection system is configured to block the respective attack when the application protection system has the first configuration settings.
6 . The method of claim 1 , further comprising:
detecting a second difference between second configuration settings of a second application protection system corresponding to a second application and second baseline configuration settings of the second application protection system, wherein the second baseline configuration settings include protections against the first plurality of attacks;
in response to detecting the second difference:
analyzing the one or more logs corresponding to the second application to determine whether the second configuration settings protect against at least the first plurality of attacks, and
determining whether the second difference comprises good drift or bad drift; and
in accordance with a determination that the second difference comprises bad drift, setting the second application protection system to have the second baseline configuration settings.
7 . The method of claim 6 , further comprising, in accordance with the determination that the second difference comprises bad drift, generating an alert indicating that bad drift has been detected.
8 . The method of claim 1 , wherein determining whether the difference comprises good drift or bad drift further comprises:
simulating the first plurality of attacks on the first application in a test environment; and
determining, based on the simulation, whether the first configuration settings include protections against at least the first plurality of attacks.
9 . The method of claim 8 , wherein determining whether the first configuration settings include protections against at least the first plurality of attacks includes comparing a first plurality of attack signatures associated with the first plurality of attacks to the first configuration settings.
10 . A device comprising:
a memory; and
one or more processors implemented in circuitry and in communication with the memory, the one or more processors configured to:
detect a difference between first configuration settings of an application protection system corresponding to a first application and baseline configuration settings of the application protection system, wherein the baseline configuration settings include protections against a first plurality of attacks;
in response to detecting the difference:
analyze one or more logs corresponding to the first application to determine whether the first configuration settings protect against at least the first plurality of attacks, and
determine whether the difference comprises good drift or bad drift, wherein the difference comprises good drift if the one or more logs include indications that known potential attacks included in at least the first plurality of attacks are detected, blocked, or reported by the application protection system corresponding to the first application and wherein the difference comprises bad drift if the one or more logs include indications that the known potential attacks included in at least the first plurality of attacks failed to be detected, blocked, or reported by the application protection system corresponding to the first application; and
in accordance with a determination that the difference comprises good drift, maintain the first configuration settings for the application protection system.
11 . The device of claim 10 , wherein the one or more processors are further configured to, in accordance with the determination that the difference comprises good drift, update the baseline configuration settings to the first configuration settings, wherein the first configuration settings include protections against an additional attack that is not included in the baseline configuration settings.
12 . The device of claim 10 , where the one or more processors are further configured to, in accordance with the determination that the difference comprises good drift, update second configuration settings of a second application protection system corresponding to a second application within a same network as the first application to be substantially similar to the first configuration settings.
13 . The device of claim 10 , wherein the first configuration settings disable a first rule corresponding to a respective attack, and wherein to analyze the one or more logs, the one or more processors are further configured to analyze the one or more logs corresponding to the first application to determine whether the first configuration settings include one or more second rules that provide protection against at least the respective attack.
14 . The device of claim 10 , wherein the first configuration settings disable a first rule corresponding to a respective attack, and wherein to analyze the one or more logs, the one or more processors are further configured to:
identify an attack payload corresponding to the respective attack in the one or more logs corresponding to the first application, wherein the application protection system blocked the respective attack for the first application when the application protection system had the baseline configuration settings; and
determine whether the application protection system is configured to block the respective attack when the application protection system has the first configuration settings.
15 . The device of claim 10 , wherein the one or more processors are further configured to:
detect a second difference between second configuration settings of a second application protection system corresponding to a second application and second baseline configuration settings of the second application protection system, wherein the second baseline configuration settings include protections against the first plurality of attacks;
in response to detect the second difference:
analyze the one or more logs corresponding to the second application to determine whether the second configuration settings protect against at least the first plurality of attacks, and
determine whether the second difference comprises good drift or bad drift; and
in accordance with a determination that the second difference comprises bad drift, set the second application protection system to have the second baseline configuration settings.
16 . The device of claim 15 , wherein the one or more processors are further configured to:
in accordance with the determination that the second difference comprises bad drift, generate an alert indicating that bad drift has been detected.
17 . The device of claim 10 , wherein to determine whether the difference comprises good drift or bad drift, the one or more processors are further configured to;
simulate the first plurality of attacks on the first application in a test environment; and
determine, based on the simulation, whether the first configuration settings include protections against at least the first plurality of attacks.
18 . The device of claim 17 , wherein to determine whether the first configuration settings include protections against at least the first plurality of attacks, the one or more processors are configured to compare a first plurality of attack signatures associated with the first plurality of attacks to the first configuration settings.
19 . Non-transitory computer-readable media storing instructions that, when executed by a computing system, cause one or more processors of the computing system to:
detect a difference between first configuration settings of an application protection system corresponding to a first application and baseline configuration settings of the application protection system, wherein the baseline configuration settings include protections against a first plurality of attacks;
in response to detecting the difference:
analyze one or more logs corresponding to the first application to determine whether the first configuration settings protect against at least the first plurality of attacks, and
determine whether the difference comprises good drift or bad drift, wherein the difference comprises good drift if the one or more logs include indications that known potential attacks included in at least the first plurality of attacks are detected, blocked, or reported by the application protection system corresponding to the first application and wherein the difference comprises bad drift if the one or more logs include indications that the known potential attacks included in at least the first plurality of attacks failed to be detected, blocked, or reported by the application protection system corresponding to the first application; and
in accordance with a determination that the difference comprises good drift, maintain the first configuration settings for the application protection system.
20 . The non-transitory computer-readable media of claim 19 , wherein the instructions further cause the one or more processors to, in accordance with the determination that the difference comprises good drift, update the baseline configuration settings to the first configuration settings, wherein the first configuration settings include protections against an additional attack that is not included in the baseline configuration settings.