System and method for automated configuration of application firewalls
View Patent ↗In a system for configuring a web application firewall, one or more parameters of the firewall are adjusted such that a test configured for exposing a vulnerability of an application protected by the application firewall is blocked by the firewall and another test configured to invoke functionality of the application but that does not expose or exploit any security vulnerability is not blocked by the firewall. A notification is provided to a user if such a firewall configuration is not found after a specified number of attempts.
1. A method for configuring an application firewall, the method comprising the steps of:
receiving in memory a current application firewall configuration comprising a first firewall configuration parameter and a value thereof;
accessing information associated with an application to be protected by the application firewall;
generating an application architecture based on, at least in part, the accessed information;
identifying a security defect in the application, wherein identifying the security defect comprises analyzing the application architecture;
transmitting through the application firewall, to the application, a first test that is adapted to expose the identified security defect in the application;
if the application firewall fails to block the transmission of the first test to the application, determining a modification to the value of the first firewall configuration parameter of the application firewall and adjusting the first firewall configuration parameter according to the determined modification, so as to block the transmission of the first test to the application; and
transmitting to the application, through the application firewall, a second test adapted to invoke a functionality of the application and determining if the functionality was invoked according to a benchmark, by receiving a result produced by the application, wherein the functionality of the application comprises functionality invoked in response to a user request.
2. The method of claim 1 , further comprising:
determining at least one user input field of the application to be protected by the application firewall; and
providing, as part of the second test, test data to the user input field.
3. The method of claim 1 , wherein identifying the security defect comprises identifying an input field within the application that is vulnerable to a cross-site scripting attack.
4. The method of claim 1 , further comprising:
if, after the transmission of the second test, the functionality was not invoked according to the benchmark, determining a modification to at least one of the value of the first firewall configuration parameter and a value of a second firewall configuration parameter of the application firewall so as to permit invocation of the functionality according to the benchmark, in response to retransmission of the second test.
5. The method of claim 4 , further comprising:
if the modified application firewall fails to block the transmission of the first test to the application, determining at least one of: (i) another modification to the value of the first firewall configuration parameter, (ii) another modification to the value of the second firewall configuration parameter, and (iii) a modification to a value of a third firewall configuration parameter of the application firewall, so as to block the transmission of the first test to the application.
6. The method of claim 4 , further comprising:
if the modified application firewall fails to block the transmission of the first test to the application, notifying a user that the identified security defect was not blocked by the application firewall.
7. The method of claim 1 , wherein determining if the functionality was invoked according to the benchmark comprises:
requesting and receiving transaction data from the application firewall; and
determining using the transaction data if the application firewall blocked the transmission of the second test to the application.
8. The method of claim 1 , wherein determining if the functionality was invoked according to the benchmark comprises:
receiving, through the application firewall, a response of the application; and
comparing the response to the benchmark.
9. The method of claim 1 , further comprising:
transmitting the second test to the application directly; and
recording as the benchmark, a response received directly from the application.
10. The method of claim 1 , wherein the identified security defect is related to at least one of SQL injection, denial of service, credit card exposure, buffer overflow, Operating System (OS) command injection, and phishing.
11. The method of claim 1 , wherein:
a plurality of firewall configuration parameters comprising the first firewall configuration parameter is associated with the application firewall; and
the first firewall configuration parameter is selected from the group consisting of: request limits parameters, cookie parameters, URL protection parameters, and parameters specifying processing of special characters or keywords.
12. A system comprising: a
first processor; and
a first memory coupled to the first processor, the first memory comprising instructions which, when executed by a processing unit comprising at least one of the first processor and a second processor, program the processing unit, for configuring an application firewall, to:
receive in a memory module comprising at least one of the first memory and a second memory coupled to the second processor, a current application firewall configuration comprising a value of a first firewall configuration parameter;
access information associated with an application to be protected by the application firewall;
generate an application architecture based on, at least in part, the accessed information;
identify a security defect in the application, wherein identification of the security defect includes analysis of the application architecture;
transmit through the application firewall, to the application, a first test that is adapted to expose the identified security defect in the application;
if the application firewall fails to block the transmission of the first test to the application, determine a modification to a value of the first firewall configuration parameter of the application firewall and adjust the first firewall configuration parameter according to the determined modification, so as to block the transmission of the first test to the application; and
transmit to the application, through the application firewall, a second test adapted to invoke a functionality of the application and determine if the functionality was invoked according to a benchmark, by receiving a result produced by the application, wherein the functionality of the application comprises functionality invoked in response to a user request.
13. The system of claim 12 , wherein the instructions further program the processing unit to:
determine at least one user input field of the application to be protected by the application firewall; and
provide, as part of the second test, test data to the user input field.
14. The system of claim 12 , wherein the instructions for identifying the security defect program the processing unit to identify an input field within the application that is vulnerable to a cross-site scripting attack.
15. The system of claim 12 , wherein the instructions further program the processing unit to:
if, after the transmission of the second test, the functionality was not invoked according to the benchmark, determine a modification to at least one of the value of the first firewall configuration parameter and a value of a second firewall configuration parameter of the application firewall so as to permit invocation of the functionality according to the benchmark, in response to retransmission of the second test.
16. The system of claim 15 , wherein the instructions further program the processing unit to:
if the modified application firewall fails to block the transmission of the first test to the application, determine at least one of: (i) another modification to the value of the first firewall configuration parameter, (ii) another modification to the value of the second firewall configuration parameter, and (iii) a modification to a value of a third firewall configuration parameter of the application firewall, so as to block the transmission of the first test to the application.
17. The system of claim 15 , wherein the instructions further program the processing unit to:
if the modified application firewall fails to block the transmission of the first test to the application, notify a user that the identified security defect was not blocked by the application firewall.
18. The system of claim 12 , wherein the instructions for determining if the functionality was invoked according to the benchmark program the processing unit to:
request and receive transaction data from the application firewall; and
determine using the transaction data if the application firewall blocked the transmission of the second test to the application.
19. The system of claim 12 , wherein the instructions for determining if the functionality was invoked according to the benchmark program the processing unit to:
receive, through the application firewall, a response of the application; and
compare the response to the benchmark.
20. The system of claim 12 , wherein the instructions further program the processing unit to:
transmit the second test to the application directly; and
record as the benchmark, a response received directly from the application.
21. The system of claim 12 , wherein the identified security defect is related to at least one of SQL injection, denial of service, credit card exposure, buffer overflow, Operating System (OS) command injection, and phishing.
22. The system of claim 12 , wherein:
a plurality of firewall configuration parameters comprising the first firewall configuration parameter is associated with the application firewall; and
the first firewall configuration parameter is selected from the group consisting of: request limits parameters, cookie parameters, URL protection parameters, and parameters specifying processing of special characters or keywords.
23. An article of manufacture comprising a non-transitory storage medium having stored therein instructions which, when executed by a processor, program the processor, for configuring an application firewall, to:
receive in memory coupled to the processor, a current application firewall configuration comprising a value of a first firewall configuration parameter;
access information associated with an application to be protected by the application firewall;
generate an application architecture based on, at least in part, the accessed information;
identify a security defect in the application, wherein identification of the security defect includes analysis of the application architecture;
transmit through the application firewall, to the application, a first test that is adapted to expose the identified security defect in the application;
if the application firewall fails to block the transmission of the first test to the application, determine a modification to the value of the first firewall configuration parameter of the application firewall and adjust the first firewall configuration parameter according to the determined modification, so as to block the transmission of the first test to the application; and
transmit to the application, through the application firewall, a second test adapted to invoke a functionality of the application and determine if the functionality was invoked according to a benchmark, by receiving a result produced by the application, wherein the functionality of the application comprises functionality invoked in response to a user request.