You can create several types of security policies. It is a good idea to understand your options before you begin.
|Security policy type||Description|
|Automatic security policy||Create a security policy for a web application by having the system examine traffic and create the policy based on statistical analysis of the traffic and the intended behavior of the application. The system stabilizes and enforces the security policy when it processes sufficient traffic over a period of time. You have the option of modifying the policy manually, as well, to speed up policy creation.|
|Manual security policy||Use rapid deployment or an application-ready security policy (pre-configured template) to develop a security policy so you can develop a policy manually. The system creates a basic security policy that you can review and fine-tune. When the security policy includes all the protections that you need, and does not produce any false positives, you can enforce the security policy.|
|Security policy integrated with vulnerability assessment tool||Create a security policy based on integrating the output from a vulnerability assessment tool, such as WhiteHat Sentinel, IBM® AppScan®, Trustwave® App Scanner (Cenzic), Qualys®, Quotium Seeker®, HP WebInspect, or a generic scanner if using another tool. Based on the results from an imported vulnerability report, Application Security Manager™ creates a policy that automatically mitigates the vulnerabilities on your web site. You can also review and fine-tune the policy. When the security policy includes all the protections that you need and does not produce any false positives, you can enforce the security policy.|
|Parent security policy||Create a security policy that can form the basis of other related security policies. This is useful if you have several similar applications for which you want to create security policies. Selected settings in the parent policy are inherited by child policies that you create. By adjusting the parent policy, the child policies are changed as well.|
|Child security policy||Create a security policy that is based on a parent security policy. When you create a child policy, the values for the settings are inherited from the parent. You can edit some of the settings and others can only be changed in the parent policy.|
|Template security policy||Use a template to populate the attributes of a new policy. The template is only used when creating the policy - a security policy is always created based on a user-defined or system-supplied template. Unlike parent policies, the templates do not affect the policy after it is created. If you modify a template, policies created from them in the past are not affected.|
Before you create and deploy a security policy, you should have an understanding of the application you are trying to protect and why you are trying to protect it. By defining your security problem, you will have an easier time creating and enforcing your security policy.
Some of the questions you might consider before you start are:
A strict, application-specific security policy can potentially take more time and effort to maintain, especially in light of application changes. A generic policy requires less maintenance, even when applied to multiple applications. Some situations will require more extensive tuning of the security policy while in other cases a simple policy will provide effective protection from attacks.
You can use the Application Security Manager™ (ASM) to help you build a security policy that is tailored to your environment. ASM can build a policy automatically, or you can do it manually. The policy building tool is called the Real Traffic Policy Builder® (referred to simply as the Policy Builder). The Policy Builder adds suggestions for strengthening a security policy based on settings that you configure, and the characteristics of the traffic going to and from the web application that the system is protecting. If using automatic learning, the system implements the learning suggestions and automatically builds the policy when sufficient traffic and time has passed. If using manual learning, you can review the suggestions and develop the policy adding the policy elements and features you want.
Here we take you through the steps of creating a simple security policy to introduce you to ASM.
The system examines the traffic to the web application making suggestions for more specifically building the security policy. The Policy Builder selectively learns new entities like file types, parameters, and cookies used in requests to the application. When ASM processes sufficient traffic, it automatically adds the entities to the security policy, and enforces them.
The system applies a basic set of attack signatures to the security policy and puts them in staging (by default, for 7 days). If you specified server technologies, additional attack signatures are included. ASM reports common attacks discovered by comparison to the signatures but does not block these attacks until the staging period is over and they are enforced. That gives you a chance to be sure that these are actual attacks and not legitimate requests.
When you create a security policy, you have a basic security policy that immediately starts to protect your web application. The Real Traffic Policy Builder® starts examining the application traffic, and fine-tunes the security policy using the guidelines you configured.
The Policy Builder builds the security policy as follows:
The Policy Builder automatically discovers and populates the security policy with the policy elements (such as file types, URLs, parameters, and cookies). On the Traffic Learning screen, you can monitor general policy building progress, review learning suggestions and deal with those you must handle manually, and see the number of elements that have been included in the policy.
If you create a security policy with the Learning Mode set to Automatic, the Real Traffic Policy Builder® does automatic policy building. This is how it works:
This is generally how the system automatically builds security policies. You can always control the way the security policy works by making changes manually and configuring additional layers of security based on the unique needs of your environment. Also, you have the option of changing the learning mode to Manual.
After you create a security policy and begin sending traffic to the application, the system provides learning suggestions concerning additions to the security policy based on the traffic it sees. For example, you can have users or testers browse the web application. By analyzing the traffic to and from the application, Application Security Manager™ generates learning suggestions or ways to fine-tune the security policy to better suit the traffic and secure the application.
|Accept Suggestion||The system modifies the policy by taking the suggested action, such as adding an entity that is legitimate. If the entity that triggered the suggestion can be placed in staging (file types, URLs, parameters, cookies, or redirection domains), clicking Accept Suggestion displays a second option, Accept suggestion and enable staging on Matched <<entity>>. Click this option to accept the suggestion and place the matched entity in staging.|
|Delete Suggestion||The system removes the learning suggestion, but the suggestion reoccurs if new requests cause it. The learning score of the suggestion starts over from zero in that case.|
|Ignore Suggestion||The system does not change the policy and stops showing this suggestion on the Traffic Learning screen now and in the future. You can view ignored suggestions by filtering by status ignored.|
If you know that a suggestion is valid, you can accept it at any time even before the learning score reaches 100%. The ones that reach 100% have met all the conditions so that they are probably legitimate entities.
Some learning suggestions must be resolved manually even if you are using the Automatic Learning Mode to create a security policy. Suggestions typically require manual intervention if they may have a large impact on the policy or involve changing an attribute that was manually and deliberately set in the policy, such as a disallowed geolocation or a session ID in a URL. In these cases, the system does not change the policy unless you accept the suggestion manually.
You can easily see the suggestions that you need to resolve manually because they are marked with an icon on the Traffic Learning screen as shown in the figure. You can also use the advanced filter to view the suggestions the have Learning Mode set to Manual, and this would list the suggestions you need to resolve.
Suggestions that must be resolved manually
If you are using the Manual Learning Mode, you must resolve all of the suggestions manually.
The Application Security Manager™ provides additional security protections for a security policy. Some of these protections are automatically enabled depending on the type of security policy you create.
|Feature||Description and Location|
|DoS attack prevention||Prevents Denial of Service (DoS) attacks based on latency and/or transaction rates (also using behavioral analysis, geolocation, CAPTCHA challenge, heavy URL detection, proactive web scraping detection, and blacklisting). Click. You create a DoS profile with Application Security enabled to configure Layer 7 DoS protection.|
|Brute force prevention||Stops attempts to break in to secured areas of a web application by trying exhaustive, systematic, login combinations. Click.|
|IP Address Intelligence||Logs and blocks attacks from IP addresses that are in the IP Address Intelligence Database and are considered to have a bad reputation. Click.|
|Web scraping detection||Mitigates web scraping (web data extraction) on web sites by attempting to determine whether a web client source is human. Click.|
|Geolocation enforcement||Lets you specify countries from which users can and cannot access the web application. To set geolocation restrictions, click.|
|CSRF protection||Prevents cross-site request forgery (CSRF) where a user is forced to perform unwanted actions on a web application where the user is currently authenticated. Click.|
|Sensitive data masking||Protects sensitive data in responses such as a credit card number, U.S. Social Security number, or custom pattern. Click Mask Credit Card Numbers in Request Log option in the policy properties.. Create sensitive parameters if needed (they are also masked); click . As an additional protection, set the|
|Anti-virus protection||Configures the system as an Internet Content Adaptation Protocol (ICAP) client so that an external ICAP server can inspect HTTP file uploads for viruses before releasing the content to the web server. To set up the ICAP server, click.|