Web Application Firewall - Friend of your DevOps Chains – Franziska Bühler

A Web Application Firewall may cause fear that it doesn’t fit into the DevOps methodology. But what if a WAF is involved very early in the DevOps process and not just at its end?

The problem is that when a WAF is added to production, the impact on the application is tested too late. Application developers get extremely late feedback and the WAF can probably break the application. I will show a way how to integrate a WAF and its testing into the deployment pipeline. A WAF is an opportunity to automatically test the application and its security with fast feedback loops. It should already be an integral part of the application testing during the continuous integration and before the application can go to release.

The audience will also learn about the Web Application Firewall ModSecurity and its Core Rule Set. It is the first line of defense against web application attacks, like those described by the OWASP Top Ten. The Core Rule Set is mentioned as one of the possible precautions against A10:2017-Insufficient Logging & Monitoring.

Transcript

1. Web Application Firewall 
 Friend of your DevOps Chain?
2. Spread the word about WAFs
3. WAF a Part of DevOps
4. …that is what we need!
5. …your WAF broke our app…
6. …any one of us!
7. Fundamental Mistake
8. Pursue this Idea
9. whoami • • Franziska Bühler • Systems Engineer at Swiss Post • OWASP ModSecurity Core Rule Set (WAF Rules) • OWASP DevSlop
10. Outline Web Application Firewall ModSecurity and Core Rule Set WAF a Part of DevOps ModSecurity at Swiss Post
11. Outline Web Application Firewall ModSecurity and Core Rule Set WAF a Part of DevOps ModSecurity at Swiss Post
12. 1st LINE OF DEFENSE APP WAF SQLi Attack XSS Attack
14. TOO LATE Code Build Test Deploy Operate
15. „We need a better process to get WAFs into production.“ - Franziska Bühler
16. TEST WAF Code Build Test Deploy Operate
17. Outline Web Application Firewall ModSecurity and Core Rule Set WAF a Part of DevOps ModSecurity at Swiss Post
18. MODSECURITY.ORG
19. MODSECURITY
20. INSTALLATION ON NGINX • $> git clone 
 https://github.com/SpiderLabs/owasp- modsecurity-crs.git • $> cp crs-setup.conf.example crs-setup.conf • Include crs-setup.conf • Include REQUEST-901-INITIALIZATION.conf • …
21. REQUEST RULES
22. MALICOUS REQUEST http://example.com/get-files?file=/../../../../etc/shadow HTTP Request CRS Rule: Path Traversal Attack (/../) CRS Rule: OS File Access Attempt CRS Rule: Common Sequence in Shell Commands
23. RESPONSE RULES
24. RESPONSE: SQL STACK TRACE
25. FALSE POSITIVE https://example.com?address=100 Union St. HTTP Request SQL injection attempt
26. FIGHT FALSE POSITIVE Fix Application Open Issue on GitHub CRS Project ModSecurity Tuning: • Tutorials https://netnea.com
27. Outline Web Application Firewall ModSecurity and Core Rule Set WAF a Part of DevOps ModSecurity at Swiss Post
28. ModSecDevOps
29. ModSec
 DevOps I Application Tests with WAF Fail early Commit triggers CI run App in deployable state
30. ModSec
 DevOps II Production-like environment Immediate Feedback App release if no CRS rule matched
31. SETUP Tests App
32. SETUP Tests WAF App
34. FAST FEEDBACK
35. CRS Container • $> docker pull franbuehler/modsecurity-crs-rp • $> docker run -dt \ • -e BACKEND=http://172.17.0.1:8000 \ • franbuehler/modsecurity-crs-rp
36. Outline Web Application Firewall ModSecurity and Core Rule Set ModSecDevOps ModSecurity at Swiss Post
37. •Every night •During deployment Apache Config Generation / Testing: ModSecurity and CRS for over 10 Years Automation for over 5 Years
38. •Automated Application Tests with WAF Expanding Deployment Pipeline Monitor ModSecurity and CRS settings
39. LINKS franbuehler/modsecurity-crs-rp https://www.owasp.org/index.php/OWASP_DevSlop_Project https://github.com/DevSlop/pixi-crs/blob/master/.circleci/config.yml https://modsecurity.org https://coreruleset.org https://netnea.com
40. WAF IS YOUR FRIEND! Additional Layer of Defense Logging and Monitoring Mechanism Virtual Patching Open Source and free Happy IT Staff
41. GIVE IT A TRY!
42. FRANZISKA BÜHLER @bufrasch @franbuehler franziska.buehler@post.ch franbuehler@gmail.com