Imperva Total Application Security Idan Soen, CISSP Security Engineer SecureSphere – The First...
-
Upload
tiffany-craig -
Category
Documents
-
view
225 -
download
0
Transcript of Imperva Total Application Security Idan Soen, CISSP Security Engineer SecureSphere – The First...
ImpervaTotal Application SecurityImpervaTotal Application Security
Idan Soen, CISSPSecurity Engineer
SecureSphere – The First Dynamic Profiling Firewall
Imperva Confidential 2
AgendaAgenda
• Imperva
• Application Security Landscape
• SecureSphere
• Imperva
• Application Security Landscape
• SecureSphere
Imperva Confidential 3
ImpervaImperva
• Company Focus: Total Application Security• Founded in 2000 by world’s elite application
security specialists – Israeli Defense Force cyber warfare team– Private sector penetration testing & app security
consultants
• Co-Founder, CEO – Shlomo Kramer – Check Point co-founder– Co-developer of Stateful Inspection
• SecureSphere Product Family– First “Dynamic Profiling Firewall”
• Company Focus: Total Application Security• Founded in 2000 by world’s elite application
security specialists – Israeli Defense Force cyber warfare team– Private sector penetration testing & app security
consultants
• Co-Founder, CEO – Shlomo Kramer – Check Point co-founder– Co-developer of Stateful Inspection
• SecureSphere Product Family– First “Dynamic Profiling Firewall”
Imperva Confidential 4
Data Center Security
Need to Secure the Data CenterData Center Security
Need to Secure the Data Center
Data Center Assets have Never Been More Critical…
…or More Vulnerable92% Vulnerable to* – Identity theft– Data theft– Worms– Denial of Service– SQL Injection– Parameter tampering
Business Implications of Attack– Lost revenue– Brand erosion– Regulatory compliance
• SOX, GLBA, HIPAA, CA SB-1386, CISP, etc
Data Center Assets have Never Been More Critical…
…or More Vulnerable92% Vulnerable to* – Identity theft– Data theft– Worms– Denial of Service– SQL Injection– Parameter tampering
Business Implications of Attack– Lost revenue– Brand erosion– Regulatory compliance
• SOX, GLBA, HIPAA, CA SB-1386, CISP, etc
Data Center & DMZCritical Servers,
Proprietary Information And Custom Business
Applications
Users
*Source: Imperva Application Defense Center
Imperva Confidential 5
Application ThreatsApplication Threats
• Web Application and Web Services attacks– External SQL injection– Attacks custom business
applications
• Web Application and Web Services attacks– External SQL injection– Attacks custom business
applications
A multi-dimensional problemA multi-dimensional problem
Internal Users
WebWebSQL injectionSQL injectionCookie poisonCookie poison
etc.etc.
DatabaseDatabaseData theftData theft
Data corruptionData corruptionetc.etc.
WormWormCode RedCode Red
NimdaNimdaetc.etc.
Data Center & DMZ
Critical Servers, Proprietary Information And Custom
Business Applications
• Database breach– Internal direct breach– Attacks proprietary information – Using legitimate access for
illegitimate purposes
• Database breach– Internal direct breach– Attacks proprietary information – Using legitimate access for
illegitimate purposes
• Worm infection– External and internal
sources of infection– Attacks critical servers– Known vulnerabilities and
“zero day” web worm
• Worm infection– External and internal
sources of infection– Attacks critical servers– Known vulnerabilities and
“zero day” web worm
Imperva Confidential 6
Data Center Security
Different Problem, Different SolutionData Center Security
Different Problem, Different SolutionCorporate Network Data Center
Assets • Desktop Computers• Microsoft Apps• Personal Files
• Proprietary Information• Custom Business Apps• Critical Servers
Threats • Client Worms• Spyware• Viruses• Data Leakage
• Identity Theft • Data Theft• Phishing• Malicious Robots • Server Worms• Denial of Service• SQL Injection
Cost • Lost Productivity • Brand, Revenue, and Regulatory Compliance
Solutions • IPS, Anti-Virus, and Personal Firewalls
• ????
Imperva Confidential 7
Securing the Data Center
A New Type of Firewall is NeededSecuring the Data Center
A New Type of Firewall is Needed
Network Access(OSI Layer 1 – 3)
Protocol Usage(OSI Layer 4 – 7)
Application and Database Usage
(New Layer 8+)
Network Layer
Application Layer
Application Logic
• Data Center Application Security not Addressed by Network Firewall or IPS Technology
– SQL Injection, Phishing, Identity theft, Data theft, Worms, Denial of Service, Malicious Robots, etc.
• SecureSphere – Data Center Firewall• Protect critical servers, proprietary information and custom business
applications
• Data Center Application Security not Addressed by Network Firewall or IPS Technology
– SQL Injection, Phishing, Identity theft, Data theft, Worms, Denial of Service, Malicious Robots, etc.
• SecureSphere – Data Center Firewall• Protect critical servers, proprietary information and custom business
applications
Perimeter Firewall
Network Firewall
Data Center Firewall
Imperva SecureSphere
Dynamic Profiling Firewall
Departmental Firewall
Intrusion Prevention
Systems (IPS) and
Deep Inspection Firewall
Imperva Confidential 8
Securing the Data Center
Point Solutions ProblematicSecuring the Data Center
Point Solutions Problematic
• Fragmented Protection– Deep Inspection Firewall– Application Firewall– Database Firewall– XML Firewall
• Static Policy & Rules– Requires constant
manual tuning
• Fragmented Management– Set policy on each device– Fragmented logging,
forensics, monitoring– No integrated reporting
• No Cooperation Between Layers• Poor Performance and Scalability
• Fragmented Protection– Deep Inspection Firewall– Application Firewall– Database Firewall– XML Firewall
• Static Policy & Rules– Requires constant
manual tuning
• Fragmented Management– Set policy on each device– Fragmented logging,
forensics, monitoring– No integrated reporting
• No Cooperation Between Layers• Poor Performance and Scalability
Data CenterWeb Servers
App. Servers, Databases
Internal Users
DMZWeb Servers, App Servers,
Databases
DI Firewall
App FirewallDatabase Firewall
XML Firewall
Imperva Confidential 9
A Dynamic Profiling Firewall must build and tune the security profile without human intervention
Automatically BuiltAutomatically Tuned
• Much more information needed for security decisions– Web App elements
• URLs, Cookies, Parameters, Users, Sessions, etc.
– Web Services elements• XML URLs, SOAP
actions, XML elements, etc.
– Database elements• SQL Queries, SQL
Tables, Users, etc.
• Too complex for manual intervention
• Much more information needed for security decisions– Web App elements
• URLs, Cookies, Parameters, Users, Sessions, etc.
– Web Services elements• XML URLs, SOAP
actions, XML elements, etc.
– Database elements• SQL Queries, SQL
Tables, Users, etc.
• Too complex for manual intervention
Dynamic Profiling Firewall
Network Layer(OSI layers 1 – 3)
Application Layer(OSI layers 4-7)
Application ProfileMillions of dynamic items
Securing the Data Center
Breaking the BarrierSecuring the Data Center
Breaking the BarrierApplication Logic and DatabasesNew layer(s)! 8+
Imperva Confidential 10
SecureSphere Dynamic Profiling Firewall
Data Center Ready SecuritySecureSphere Dynamic Profiling Firewall
Data Center Ready Security
• Unified Protection – Web, database and worm attacks– Internal and external attackers– Layers 1-7 and 8+
• Dynamic Profiling– Automatically models application
structure and dynamics • Web Application: URLs, cookies, users,
parameters, sessions, etc.• Web Services: XML URLs, SOAP actions,
XML elements, etc.• Database: SQL queries, SQL tables,
parameters, users, etc.
– No on-going manual tuning • Adapts when application changes
• Centralized Management • Enforcement & Auditing Across Layers• High Performance and Highly Scalable
• Unified Protection – Web, database and worm attacks– Internal and external attackers– Layers 1-7 and 8+
• Dynamic Profiling– Automatically models application
structure and dynamics • Web Application: URLs, cookies, users,
parameters, sessions, etc.• Web Services: XML URLs, SOAP actions,
XML elements, etc.• Database: SQL queries, SQL tables,
parameters, users, etc.
– No on-going manual tuning • Adapts when application changes
• Centralized Management • Enforcement & Auditing Across Layers• High Performance and Highly Scalable
Internal Users
SecureSphere G4 Gateways
SecureSphere MX Management Server
Data CenterWeb Servers
App. Servers, Databases
DMZWeb Servers
App Servers, Databases
Imperva Confidential 11
Security Coverage
SecureSphere Secures the Data Center Security Coverage
SecureSphere Secures the Data Center
SecureSphere Protects Against
• Web Application Attack– Both Interface and Logic
• Web Services Attack– SOAP/XML interfaces
• Database Breach– Direct Database Attacks– Via Web Application– Via Web Services
• Worm/Platform Attack – Network Stack– Operating Systems– Infrastructure Server Software
SecureSphere Protects Against
• Web Application Attack– Both Interface and Logic
• Web Services Attack– SOAP/XML interfaces
• Database Breach– Direct Database Attacks– Via Web Application– Via Web Services
• Worm/Platform Attack – Network Stack– Operating Systems– Infrastructure Server Software
Web Application
& Web Service(Custom to Package)
Application Logic
(Custom to Package)
Application Databases
(Custom to Package)
Web Server
Application Server
Database Servers
Operating System
Operating System
Operating System
Network Stack
Network Stack
Network
Stack
Application Data CenterInfrastructure
Imperva Confidential 12
Web Application
& Web Service(Custom to Package)
Application Logic
(Custom to Package)
Application Databases
(Custom to Package)
Web Server
Application Server
Database Servers
Operating System
Operating System
Operating System
Network Stack
Network Stack
Network
Stack
Security Coverage
SecureSphere – IPSSecurity Coverage
SecureSphere – IPS
• Protects Critical Data Center Servers– Operating System Platform
• agnostic of vendor / version– Server Software– Network Access– Network Protocols
• Attacks Prevented– Server Worms– Unauthorized Access– Protocol Attacks
• Defenses– User and protocol access control– Protocol Validation and Usage– Full Snort®-compatible signature
protection– Imperva’s Advanced ADC defenses– Web Worm Profiling
• Protects Critical Data Center Servers– Operating System Platform
• agnostic of vendor / version– Server Software– Network Access– Network Protocols
• Attacks Prevented– Server Worms– Unauthorized Access– Protocol Attacks
• Defenses– User and protocol access control– Protocol Validation and Usage– Full Snort®-compatible signature
protection– Imperva’s Advanced ADC defenses– Web Worm Profiling
Application Data CenterInfrastructure
Imperva Confidential 13
Web Application
& Web Service(Custom to Package)
Application Logic
(Custom to Package)
Application Databases
(Custom to Package)
Web Server
Application Server
Database Servers
Operating System
Operating System
Operating System
Network Stack
Network Stack
Network
Stack
Security Coverage
SecureSphere - Web App Firewall Security Coverage
SecureSphere - Web App Firewall
• Dynamic Profiling Protects “Traditional” Web App Elements
– Application Logic• Form fields, cookies, URLs,
Parameters
– Agnostic Web / App Server Software• Apache, IIS, etc.
• Example Attacks Prevented– Cross-site scripting– SQL Injection– Command Injection– Illegal encoding– Buffer Overflows– Cookie Poisoning– Parameter Tampering– Form Field Tampering– Malicious Scanning / Robots– Phishing– Denial of Service
• Integrated IPS Protects the OS and the Network (point solutions don’t)
• Dynamic Profiling Protects “Traditional” Web App Elements
– Application Logic• Form fields, cookies, URLs,
Parameters
– Agnostic Web / App Server Software• Apache, IIS, etc.
• Example Attacks Prevented– Cross-site scripting– SQL Injection– Command Injection– Illegal encoding– Buffer Overflows– Cookie Poisoning– Parameter Tampering– Form Field Tampering– Malicious Scanning / Robots– Phishing– Denial of Service
• Integrated IPS Protects the OS and the Network (point solutions don’t)
Application Data CenterInfrastructure
Imperva Confidential 14
Security Coverage
SecureSphere - XML Firewall Security Coverage
SecureSphere - XML Firewall
• Dynamic Profiling Protects Web Services Elements
– Application / Web Servers• Agnostic to vendor brands
– Web Services Protocols and Standards • XML, SOAP, WSDL
• Attacks Prevented– “Element Tampering”– “Structure Tampering”– SQL Injection– Command Injection– Illegal encoding– Cross Site Scripting– Buffer Overflow
• Integrated IPS Protects the OS and the Network (point solutions don’t)
• Dynamic Profiling Protects Web Services Elements
– Application / Web Servers• Agnostic to vendor brands
– Web Services Protocols and Standards • XML, SOAP, WSDL
• Attacks Prevented– “Element Tampering”– “Structure Tampering”– SQL Injection– Command Injection– Illegal encoding– Cross Site Scripting– Buffer Overflow
• Integrated IPS Protects the OS and the Network (point solutions don’t)
Application Data CenterInfrastructure
Web Application
& Web Service(Custom to Package)
Application Logic
(Custom to Package)
Application Databases
(Custom to Package)
Web Server
Application Server
Database Servers
Operating System
Operating System
Operating System
Network Stack
Network Stack
Network
Stack
Imperva Confidential 15
Deployment
Performance and ScalabilityDeployment
Performance and Scalability
• High Performance– Up to 1 Gbps throughput
– Sub millisecond latency
– Up to 8,000 transaction/second
• Scalability– G4: Entry for small to medium
segments
– G8: Performance for larger segments
– MX: Centralized management for multi-gateway environments
• High Performance– Up to 1 Gbps throughput
– Sub millisecond latency
– Up to 8,000 transaction/second
• Scalability– G4: Entry for small to medium
segments
– G8: Performance for larger segments
– MX: Centralized management for multi-gateway environments
G4 Gateway ApplianceThroughput 500 Mbps
Requests Per Second 4000
Form Factor 1U
Max Sniffing Interfaces 3
Max Inline Segments 1
G8 Gateway ApplianceThroughput 1000 Mbps
Requests Per Second 8000
Form Factor 1U
Max Sniffing Interfaces 3
Max Inline Segments 1
Imperva Confidential 16
Operations
Centralized ManagementOperations
Centralized Management
• Centralized Management Services– Manages all devices from a single console
– Application level profiles and policy
– Integrated logging and forensics
– User specific alerts and monitoring
– Integrated compliance reporting
• Scalable for Large Deployments– Three-tier architecture
– Browser-based interface
– Role-based administration
– Easy appliance deployment
• Appliances auto-configured by mgt server
• Centralized Management Services– Manages all devices from a single console
– Application level profiles and policy
– Integrated logging and forensics
– User specific alerts and monitoring
– Integrated compliance reporting
• Scalable for Large Deployments– Three-tier architecture
– Browser-based interface
– Role-based administration
– Easy appliance deployment
• Appliances auto-configured by mgt server
MX Management MX Management ServerServer
SecureSphere Gateway SecureSphere Gateway AppliancesAppliances
BrowserBrowserInterfaceInterface
Imperva Confidential 17
Summary
Securing the Data CenterSummary
Securing the Data Center
• Businesses Vulnerable to New Data Center Threats– Identity theft, data theft, SQL injection, worms, and DoS– Risking brand, revenue, and regulatory compliance
• IPS and Network Firewalls are Not Enough– Do not protect proprietary information and custom business applications
• SecureSphere - Data Center Ready Protection– Security
• Protects proprietary information, custom applications, and critical servers• Blocks even the most sophisticated attacks
– Deployment• No change to existing applications and infrastructure• Flexible networking and high availability• Performance and scalability
– Operations• No manual tuning• Centralized management
Low TCO and High ROI
• Businesses Vulnerable to New Data Center Threats– Identity theft, data theft, SQL injection, worms, and DoS– Risking brand, revenue, and regulatory compliance
• IPS and Network Firewalls are Not Enough– Do not protect proprietary information and custom business applications
• SecureSphere - Data Center Ready Protection– Security
• Protects proprietary information, custom applications, and critical servers• Blocks even the most sophisticated attacks
– Deployment• No change to existing applications and infrastructure• Flexible networking and high availability• Performance and scalability
– Operations• No manual tuning• Centralized management
Low TCO and High ROI
Imperva Confidential 18
Thank YouThank You
Imperva Inc.
950 Tower Lane, Suite 1710Foster City, CA 94404 Sales: (866) 926-4678
www.imperva.com
Imperva Confidential 19
MX ManagementMX Management
DatabaseDatabase
Y2Y2
GatewayGateway
G2G2
Web App Web App X1X1
Web App Web App X2X2
GatewayGateway
G1G1
Database Database Y1Y1
OOBOOBOOBOOB
Test EnvTest EnvReal Life Real Life
EnvEnv