7 Myths about protecting Web applications.

Today Web Applications are delivering critical information to a growing number of employees and partners. Most organizations have already invested heavily in Network Security Devices, thus they often believe they are also protected at the application layer; in fact they are NOT.

Myth 1: IPS defeat Application Attacks

Intrusion Prevention Systems, initially developed to monitor and alert on suspicious activity and system behavior, are becoming widely deployed. IPS's are useful to detect known attacks, but are inadequate to protect against new types of attack targeting the web applications and are often blind for traffic secured by SSL technology.

Myth 2: Firewalls protect the Application Layer

Most companies have deployed firewall technology to protect and control traffic in and out of the network. Firewalls are designed to control access by allowing or blocking IP addresses and port numbers. As well as firewalls are still failing to protect against worms and viruses, they are not suited to protect web applications against application attacks neither. Network firewalls only protect or 'validate' the HTTP protocol and do not secure the most critical part: the application.

Myth 3: Application vulnerabilities are similar to

Network and System vulnerabilities A common problem in web applications is the lack of input validation in web forms. For example, a web form field requesting an email address should only accept characters that are allowed to appear in email addresses, and should carefully reject all other characters! An attacker might potentially delete or modify a database 'safely' hidden behind state of the art-Network Firewalls, IPS and web servers by filling in SQL query syntax in the unsecured email field and exploit a SQL Injection vulnerability! Web application attacks are not targeting protocols, but target badly written applications using HTTP(s).

Myth 4: Network devices can understand the application context

To correctly protect web applications and web services, a full understanding of the application structure and logic must be acquired. Track must be kept of the application state and associated sessions. Different technologies, such as cookie insertion, automated process detection, application profiling and web single sign on technology are required to obtain adequate application protection.

Myth 5: SSL secures the application.

SSL technology is initially developed to secure and to authenticate traffic in transit. SSL technology protects against man-in-the-middle attacks (eaves dropping) or data alteration attacks (modifying data in transit), but do not secure the application logic. Most vulnerabilities found in today's web servers are exploitable via unsecured HTTP connections as well as via 'secured 1 HTTPS connections.

Myth 6 : Vulnerability scanners protect the web environment

Vulnerability scanners look for weaknesses based on signature matching. When a match is found a security issue is reported. Vulnerability scanners work almost perfect for all popular systems and widely deployed applications, but prove to be unable at the web application layer because companies do not use the same web environment software, most of them even opt for creating their own web application.

Myth 7 : Vulnerability assessment and Patch Management will do the job

While it is often required to have yearly security assessments performed on a web site, the common web application life cycle requires more frequent security reviews. As each new revision of a web application is developed and pushed, the potential for new security issues increases. Pen Test or Vulnerability assessments will ever be out of date. Furthermore, it is illusive to imagine that Patch Management will assist to rapidly respond to the identified vulnerabilities.

The real Life

Web applications are currently proving to be one of the most powerful communication and business tool. But they also come with weakness and potential risk that network security devices are simply not designed to protect. Key security concepts such as Security Monitoring, Attack Prevention, User Access control and Application Hardening, remain true. But, because web application domain is so wide and different, these concepts need to be implemented with new "application oriented" technologies.

Eric Battistoni, Bee-ware