Configuring an Enhanced Standard Security Policy

Transcription

1 Configuring an Enhanced Standard Security Policy What is an enhanced standard security policy? Implementing an enhanced standard security policy

2

3 Configuring an Enhanced Standard Security Policy What is an enhanced standard security policy? The core of the Application Security Module s security functionality is the security policy. The security policy is a map of the web application itself. When the Application Security Module receives an incoming HTTP or HTTPS request for a web application, the system compares the request to the active security policy. If the request complies with the security policy, the system forwards the request to the web application. If the request does not comply with the security policy, the system either issues an alert and blocks the request, or issues an alert and forwards the request. The system action is dependent on the specific security policy settings that you have configured. The enhanced standard security policy is a standard security policy that you have subsequently customized for the relatively few objects and associated parameters that have special security needs. For example, you should consider implementing an enhanced standard security policy if your web application contains the following components: Pages that require specific meta characters, which are restricted in the global metacharacter set of a standard security policy Binary uploaded pages You can configure the enhanced standard security policy on any application for which the standard security policy is acceptable for the majority of the web objects. The benefit of creating an enhanced standard security policy is that it allows you to change the standard security policy settings as needed for specific components, while avoiding the longer setup time required when implementing a high security (APC) policy. When you implement an enhanced standard security policy, the Application Security Module enforces precise parameters for specific objects, while the standard security policy continues to apply to the rest of the site components. Implementing an enhanced standard security policy To implement an enhanced standard security policy, you create and modify a standard security policy, by performing these tasks: Create a standard security policy Create an object type Define an allowed object regular expression Create a web object Create an application flow Define the flow parameter/value pairs Define the security level checks Set the active security policy for a web application This solution describes these tasks in detail. 1-1

4 Creating a standard security policy Since the enhanced standard security policy is based on the standard security policy, you first need to create a standard security policy. You can create a standard security policy by copying an existing policy, or by creating a new one from scratch. To copy a standard security policy 1. On the Main tab in the navigation pane, expand Application 2. In the Name column, click the name of the web application from which you want to copy the standard security policy. The Web Application properties screen opens. 3. In the Policies List, select the security policy that you want to copy, and click the Copy button below the list. The Copy Policy screen opens. 4. In the New Policy Name box, type a name for the new security policy, and then click Copy. For example, mywebapp_default_enhanced_policy. The system displays a success message when the copy is complete. 5. Click the OK button. The screen refreshes, and the new security policy displays in the Policies List. To create a new standard security policy 1. On the Main tab of the navigation pane, expand the Application Security section, and then click Web Applications. 2. In the Name column, click the web application for which you want to create a new standard security policy. The Policy Properties screen opens. 3. Click the Create button. The Create New Policy screen opens. 4. In the New Policy Name box, type a name for the security policy. For example, mywebapp_default_enhanced_policy. 5. Click the Create button. The Policy Properties screen displays. Note For general information about configuring a security policy, as well as information about its specific components, see Chapter 3, Working With the Security Policy, in the Configuration Guide for the BIG-IP Application Security Module. 1-2

5 Configuring an Enhanced Standard Security Policy Creating an object type The Object Types element lists the file extensions for all of the general file types that make up the web application. The flags that you specify for the object type determine its legitimate behavior and properties. The security policy is based on the object types list, and uses this information to determine which file types are legal for a specified web application and how to process the file types. Note Object types are case-sensitive. As a result, the security policy processes PHP and php files as separate object types. To manually create an object type for a security policy 1. On the Main tab in the navigation pane, expand Application 2. In the Name column, click the name of the web application for which you want to review the security policies. The Web Application Properties screen opens. 3. In the Policies List, in the Policy Name column, click the name of the security policy for which you want to add an object type. The Policy Properties screen opens. 4. On the menu bar, click Object Types. The Object Types screen opens. 5. Above the Object Types list, click the Create button. The Create New Object Type popup screen opens. 6. In the Object Type box, type the file extension for the object type. For example, for a php login page, you would add the php object type to the security policy, by typing php. 7. Click the Create button. The screen refreshes and the new object type displays in the list. Note When you create a new object type, it inherits default characteristics, depending on the file type that the object type represents. For the enhanced standard policy, verify that the Check Objects and Check Flow boxes are checked for the object type that you created. 1-3

6 Creating a web object A standard security policy monitors only object types. Web objects, which are an element of an APC security policy, are the specific building blocks and components of a web application. To create an enhanced standard security policy, you add one or more specific web objects to a standard security policy. In this example, we are adding a login page web object. To create a web object 1. On the Main tab in the navigation pane, expand Application 2. In the Active Policy column, click the name of the web application for which you want to review the security policies. The Web Application Properties screen opens. 3. On the menu bar, click Web Objects. The Web Application Objects (Site Map) screen opens. 4. Above the Web Application Objects list, click the Create button. The Create New Object popup screen opens. 5. In the Object Path box, type the full resource path starting with the slash [/] character. For example for the login page web object, type /login.php. 6. In the Protocol list, select the HTTP protocol, which will be used to access the object. 7. Click the Create button. The screen refreshes and displays the new web object in the list. Note For additional information about web objects, see Chapter 3, Working With the Security Policy, in the Configuration Guide for the BIG-IP Application Security Module. Defining an allowed object regular expression You can define a regular expression that matches a group of web objects of a certain object type. When you define a regular expression for an allowed object, and the Application Security Module does not find a requested object in the web objects list, the system checks to see if the object matches a defined regular expression. When it finds a match, the Application Security Module performs a more general check on the contents of the request, such as verifying character sets and object lengths, and looking for attack signatures. If there is no match against an allowed regular expression, the Application Security Module blocks the request and generates a Non existent object violation. 1-4

7 Configuring an Enhanced Standard Security Policy To define an allowed object regular expression 1. On the Main tab in the navigation pane, expand Application 2. In the Name column, click the name of the web application for which you want to define an allowed object regular expression. The Web Application Properties screen opens. 3. In the Policies List area, in the Policy Name column, click the name of the security policy for which you want to create an allowed object regular expression. The Policy Properties screen opens. 4. On the menu bar, click Objects Types. 5. Above the Allowed Objects RegExp list, click the Create button. The Create New RegExp popup screen opens. 6. In the RegExp box, type a regular expression. For example, to match.php objects for a login page you would type: (?i).*\.php$ Note: A regular expression can contain a specific directory to which you can restrict access for a given object type. For example: (?i)\/admin\/.*\.php$ 7. In the Description box, you can enter a name (optional) for the allowed object. 8. Click the Create button. The screen refreshes and the new regular expression displays in the Allowed Objects RegExp list. 9. Repeat this procedure to define any additional allowed object regular expressions that your web application needs. Important Once you configure an allowed object regular expression in a security policy, the Learning Manager stops generating learning suggestions for any web objects of the specified object type, and also for any flows or parameters related to those web objects. Creating an application flow The application flow is the defined access path leading from one object to another object, within the web application. An application flow consists of a source object, target object, method (GET or POST), and parameter/value pairs. In the enhanced standard security policy, the source object is entry point, which specifies that the client can access this page from anywhere. 1-5

8 On a login page, you may have a user name parameter that links to another page within the application. The calls from the basic page to the other objects make up the flow. To manually create an application flow 1. On the Main tab in the navigation pane, expand Application 2. In the Active Policy column, click the name of the web application for which you want to create an application flow. The Web Application Properties screen opens. 3. On the menu bar, click Web Objects. The Web Application Objects (Site Map) screen opens. 4. On the Web Objects screen, in the Web Application Objects list, click the name of the object that you created. For this example, /login.php. The Web Object Details screen opens. 5. Above the Flows to Object list, click the Create button. The Create a New Flow popup screen opens. 6. In the Referrer Object box, select Entry Point. 7. In the Method list, select an HTTP method. The method depends on the type of request expected for the page. For example, POST. 8. In the Frame Target box, type 1, which is the frame to which the web object belongs (self). 9. Click the OK button. The screen refreshes and you see the new flow that you created in the Flows to Object list. Defining the flow parameters You can define flow parameters for very tight, object-specific security. For example, for the login parameters, you may want to provide additional security for the user name and user password by specifying the acceptable user-input characters and the maximum character length. To manually define flow parameters 1. On the Main tab in the navigation pane, expand Application 2. In the Active Policy column, click the name of the web application for which you want to create an application flow. The Web Application Properties screen opens. 1-6

9 Configuring an Enhanced Standard Security Policy 3. On the menu bar, click Web Objects. The Web Application Objects (Site Map) screen opens. 4. On the Web Objects screen, in the Web Application Objects list, click the name of the object that you created. For example, /login.php. The Web Object Details screen opens. 5. In the Flows to Object section, click the object that you created. For example, Entry Point. The Object Details screen opens. 6. Confirm that the boxes are checked for Allow Query-String or POST-Data and Check Query-String or POST-Data, and the Frame Target value is Click the Create button. 8. In the Parameter Name box, type the name of the parameter. For example, username. 9. In the Parameter Type list, select a parameter type. For example, user-input. 10. In the Parameters Characteristics area, define the parameter value properties. For example, to specify a maximum number of characters allowed for the user name, check the Check Max. Length box and type a number in the field. 11. Check the Allowed Meta Characters box and check the corresponding allowed meta characters from the list. For example, (0x27). 12. Click the Update button. The Objects Detail screen refreshes. Customizing the Blocking policy settings On the Blocking Policy screen, you specify the violation types for which the system generates alarms, and the violation types for which the system blocks the violating request. To customize the blocking settings and specify relevant violations 1. On the Main tab of the navigation pane, expand the Application Security section, and then click Web Applications. 2. Click the name of the Web Application for which you want to modify the blocking policy. The Web Applications Properties screen opens. 1-7

10 3. From the Policies list, click the name of the enhanced standard security policy that you created. The Policy Properties screen opens. 4. Next to the Security Level setting, click the Edit button. The Blocking Policy screen opens. 5. Verify that the check box for Disable Blocking is checked. 6. Specify the security checks. For the enhanced standard security policy, check all the violations boxes on this screen, except for the following: Illegal entry point Illegal flow object Illegal parameter Expired timestamp Wrong message key 7. Click the Save button. Setting the active policy for a web application At any given time, the Application Security Module enforces only one security policy for a web application. The security policy that is currently protecting the web application is called the active security policy. The active security policy is marked with the Active icon in the Policies List for the web application. You need to set the active security policy in the following cases: Every time that you make a change to the security policy. A security policy that has been modified is marked with the Modified icon. If you do not re-activate the security policy after you make a change, the security policy does not reflect the latest changes. Whenever you switch from one security policy to another. To activate a security policy 1. On the Main tab of the navigation pane, expand Application 2. In the Name column, click the name of the web application for which you are activating a security policy. The Web Application properties screen opens. 3. In the New Active Policy list, select the security policy that you are activating. For example, mywebapp_default_enhanced_policy. 1-8

11 Configuring an Enhanced Standard Security Policy 4. Click the Set Active Policy button. A confirmation popup screen opens, which displays a success message. 5. Click Close. The screen refreshes, and in the Policies List, the Active Policy icon displays next to the newly activated security policy. 1-9

12 1-10