Techniques for application security
Software developers previously dealt with each security threat by incorporating a corresponding set of code lines into individual web applications, which required significant amount of time and code lines for each security threat and the resulting code was hard to maintain or modify. One aspect of the present invention addresses common security concerns in a standardized and centralized approach. All user requests for web applications are centralized to a single input and validated by a Web Security Filter. Selected layers of validation filters (e.g., ESAPI and AntiSamy) could be sequentially applied to the user requests, and those filters can be individually maintained/modified as discrete modules. Not only is this centralized, holistic approach to application security effective against a majority of malicious attacks, it is also saves a lot of time and costs in code development and maintenance.
1. A server system with a defense mechanism against security threats on application layer, comprising:
at least one application server hosting one or more applications accessible to authorized users;
a single communication interface to which all user requests to any of the hosted applications are routed; and
a security appliance coupled to the single communication interface and configured to:
receive the user requests, and
screen each of the user requests with a selected set of discrete validation filters by sequentially applying the filters to each of the user requests, wherein one of the discrete validation filters applies one or more text-based pattern matching rules to each of the user requests and another one of the discrete validation filters applies application-specific input validation rules to each of the user requests;
wherein each of the discrete validation filters are modularly configured to handle a corresponding security threat and being individually modifiable without affecting another validation filter corresponding to another security threat, and
wherein when one of the user requests is a file upload request, the one of the discrete validation filters that applies the one or more text-based pattern matching rules checks a file type against a list of acceptable file formats and a list of disallowed formats based on both file header and extension.
2. The server system according to claim 1 , wherein at least some of the user requests are HTTP or HTTPS requests.
3. The server system according to claim 1 , wherein one of the selected set of discrete validation filters comprises at least one rule for input validation in connection with the one or more applications.
4. The server system according to claim 3 , wherein the at least one rule for input validation is based on one or more whitelists of threat or attack patterns.
5. The server system according to claim 1 , wherein one of the selected set of discrete validation filters comprises at least one rule for output encoding in connection with the one or more applications.
6. The server system according to claim 1 , wherein one of the selected set of discrete validation filters comprises data cleansing.
7. A method for defending against security threats on application layer in a server system, the method comprising:
intercepting all incoming HTTP or HTTPS requests directed to one or more applications hosted on a protected web server or database in a server system, and
examining each of the incoming HTTP or HTTPS requests by sequentially:
using at least a first one of a set of discrete validation filters to apply one or more text-based pattern matching rules to each of the incoming HTTP or HTTPS requests,
using at least a second one of the set of discrete validation filters to apply application-specific input validation rules to each of the incoming HTTP or HTTPS requests; and
forwarding, based on the examining, a screened subset of the incoming HTTP or HTTPS requests to the protected web server or database,
wherein each of the discrete validation filters is modularly configured to handle a corresponding security threat and is individually modifiable without affecting another validation filter corresponding to another security threat, and
wherein when one of the incoming HTTP or HTTPS requests is a file upload request, the applying the one or more text-based pattern matching rules includes checking a file type against a list of acceptable file formats and a list of disallowed formats based on both file header and extension.
8. The method of claim 7 , further comprising:
applying Bayesian inference to refine results of the application of the text-based pattern matching rules and the application of the application-specific input validation rules.
9. The method of claim 7 , further comprising:
applying a time series statistical modeling to a group of responses returned by the protected web server or database over one or more predetermined time periods.
10. A non-transitory computer readable medium having stored thereon instructions for defending against security threats on application layer in a server system comprising machine executable code which when executed by a processor, causes the processor to:
intercept all incoming HTTP or HTTPS requests directed to one or more applications hosted on a protected web server or database in a server system, and
examine each of the incoming HTTP or HTTPS requests by sequentially:
using at least a first one of a set of discrete validation filters to apply one or more text-based pattern matching rules to each of the incoming HTTP or HTTPS requests,
using at least a second one of the set of discrete validation filters to apply application-specific input validation rules to each of the incoming HTTP or HTTPS requests; and
forwarding, based on the examining, a screened subset of the incoming HTTP or HTTPS requests to the protected web server or database,
wherein each of the discrete validation filters is modularly configured to handle a corresponding security threat and is individually modifiable without affecting another validation filter corresponding to another security threat, and
wherein when one of the incoming HTTP or HTTPS requests is a file upload request, the applying the one or more text-based pattern matching rules includes checking a file type against a list of acceptable file formats and a list of disallowed formats based on both file header and extension.
11. The non-transitory computer readable medium of claim 10 , wherein when executed by the processor, the processor is further configured to apply Bayesian inference to refine results of the application of the text-based pattern matching rules and the application of the application-specific input validation rules.
12. The non-transitory computer readable medium of claim 10 , wherein when executed by the processor, the processor is further configured to apply a time series statistical modeling to a group of responses returned by the protected web server or database over one or more predetermined time periods.