Ibhalansi phakathi kokurekhoda nokuvimba ku-WAF

Informatec Digital » Izinsiza » Ibhalansi phakathi kokurekhoda nokuvimba ku-WAF

Ukuthola ibhalansi efanele phakathi kokungena ngemvume nokuvimba ku-WAF sekungenye yezinkinga ezivame kakhulu emaqenjini okuphepha nokusebenza. I-firewall yohlelo lokusebenza lwewebhu ingamisa ukuhlaselwa okukhulu kakhulu, kodwa uma ihlelwe ngobudlova kakhulu, ingavimba ukuthenga okusemthethweni, ukufinyelela, noma izingcingo ze-API. Uma ihlelwe ngendlela ekhululekile kakhulu, igcina icishe ibe yinto yokuhlobisa kuphela. Isihluthulelo ukulungisa ngokucophelela ukuthi kufanele ungene nini ngemvume, ukuthi ubale nini, ukuthi uvumele nini, nokuthi uvimbele nini.

Kulesi sihloko, sizohlola indlela yokufinyelela leli bhalansi sisebenzisa amakhono esimanje e-WAF (vumela uhlu, imithetho esekelwe emvamisa, izindlela zokufunda, ukuhlanganiswa kwe-SIEM, ukufunda komshini, njll.), okusekelwa yizibonelo eziqondile ezivela ku -AWS WAF, i-ModSecurity, ama-WAF asekelwe efwini, kanye nezixazululo ezisezindaweni . Uzobona ukuthi unganciphisa kanjani imiphumela engamanga ngaphandle kokwehlisa izinga lokuvikelwa, ukuthi ungahlela kanjani izinqubomgomo ngohlelo lokusebenza, nokuthi ungasebenzisa kanjani ukugawula njengomsizi, hhayi njengomthombo womsindo ohlala njalo, ongalawuleki.

Iyini i-WAF futhi kungani ukubhalisa kubaluleke kangaka?

I-firewall yohlelo lokusebenza lwewebhu isebenza njengengqimba ehlakaniphile phakathi komsebenzisi neseva , ihlaziya ithrafikhi ye-HTTP/HTTPS ngesikhathi sangempela. Ngokungafani ne-firewall yenethiwekhi yendabuko, eqapha amachweba nama-IP, i-WAF ihlola ngokujulile: ama-URL, amapharamitha, imizimba yesicelo, izihloko, amakhukhi, izindlela ze-HTTP, nokuningi.

Umsebenzi wayo ukuthola nokuvimba ukuhlaselwa okuvamile kwe-Layer 7 : i-SQL injection, i-XSS, i-LFI/RFI, ukuhlaselwa kokulawulwa kokufinyelela, ukusetshenziswa kabi kwe-API, ukuklwebha okunolaka, amandla amakhulu, ngisho namaphethini athile e-DDoS ezingeni lesicelo. Ukuze yenze lokhu, ithembele kusethi yemithetho, izisayini, kanye nezinqubomgomo zokuphepha ezivuselelwa njalo.

Ukuloba kungolunye uhlangothi lwemali. Isinqumo ngasinye se-WAF—ukuvumela, ukuvimba, noma ukubala kuphela—singahambisana nesenzakalo esinemininingwane kulologi . Lalo logi luvumela:

• Phenya izehlakalo: dala kabusha okwenzekile nokuthi kwenziwa kanjani umzamo wokusebenzisa kabi ubuthakathaka.
• Lungisa imithetho: thola imiphumela engamanga ngokubona ukuthi yiziphi izicelo ezisemthethweni ezivinjelwa yi-WAF.
• Ukuthobela imithethonqubo: bonisa ukuthi kukhona izilawuli ezisebenzayo (i-PCI DSS, i-GDPR, ukuhlolwa kwangaphakathi, njll.).
• Ukondla i-SIEM: xhumanisa ukuhlaselwa kohlelo lokusebenza nemicimbi yenethiwekhi, uhlelo, ubunikazi, njll.

Inkinga ukuthi i-WAF engalungiswanga kahle ingagcwalisa izingodo ngezinkulungwane zezehlakalo ezingafanele , okwenza kube nzima ukuthola okubalulekile, futhi ngaphezu kwalokho, kubangele ukwenqatshwa okungafanele kwethrafikhi esemthethweni. Yilapho ubuciko bokudlala ngezindlela zokubhalisa, ukubala, kanye nokuvimba bungena khona.

Amamodeli okuphepha ku-WAF: uhlu lokuvimba, uhlu lwabavunyelwe, kanye nendlela ehlanganisiwe

Ama-WAF amaningi anamuhla ahlanganisa izindlela eziningana zokuhlunga, ezithinta ngqo indlela izicelo ezifakwa ngayo futhi ezivinjelwa ngayo . Ngokubanzi, singabona amafilosofi amabili akudala, kanye nemodeli ehlanganisiwe evame kakhulu.

I -WAF esekelwe kuhlu lokuvimba ilandela imodeli yokuphepha engemihle. Isimiso sayo esiyinhloko sithi: "Ngivumela konke ngaphandle kwalokho engikwaziyo ukuthi kuyingozi." Isebenza ngokusebenzisa iziginesha zokuhlaselwa okwaziwayo (i-SQL injection, i-XSS, amaphethini e-bot, njll.) kanye nemithetho echaza lokho okubhekwa njengokusolisayo. Kulula ukuyisebenzisa ekuqaleni, kodwa ukuthembela kuphela kulo modeli kuyingozi yokuvumela ama-vector amasha okuhlasela noma izinhlobo ezahlukene ukuthi zidlule zingatholakali.

I-WAF enohlu lwabavunyelwe isebenza ngendlela ephambene: "vimba konke ngaphandle kwalokho okuvunyelwe ngokusobala." Isekelwe kumodeli yokuphepha enhle. Ithrafikhi efanelana nokuziphatha okusemthethweni okuchaziwe kuphela—imizila, izindlela, amapharamitha, amafomethi, osayizi, njll.—iyamukelwa. Iphephile kakhulu, kodwa idinga ukulungiswa okuhle kakhulu futhi ingakhiqiza imiphumela emihle engamanga ekuqaleni uma ingalungiswanga kahle.

Ngenxa yezinzuzo kanye nokungalungi kwendlela ngayinye, imodeli ehlanganisiwe ehlanganisa uhlu lwabavunyelwe kanye nohlu lokuvimba iya ngokuya ivame kakhulu . Kulesi simo, amaphrofayili ethrafikhi alindelekile ayachazwa (isibonelo, ukuthi yini edala ukungena ngemvume okuvamile noma isicelo sokukhokha), futhi amasignesha kanye ne-heuristics kusetshenziswa ngesikhathi esisodwa ukuthola amaphethini ajwayelekile anonya. Ngezinjongo zokubhalisa, le ndlela ehlanganisiwe ivumela:

• Maka njengo umcimbi onobungozi obukhulu lokho okwephula uhlu lwezinto ezivunyelwe.
• Phatha njenge izexwayiso ezibaluleke kakhulu/eziphansi amaphethini ajwayelekile ohlu lokuvimba.
• Sebenzisa imodi ethi "bala" ukuze ubone ukuthi yini engaphula umthetho ngaphambi kokusebenzisa ibhulokhi.

I-WAF kunethiwekhi, ku-host, kanye nasefwini: umthelela ekulogeni nasekukhiyeni

Imodeli yokuthunyelwa kwe-WAF ithonya kakhulu indlela ukuloga nokuvinjelwa kwethrafikhi okusingathwa ngayo. Izicelo zokungena kudivayisi yenethiwekhi azifani nokuzingena ku-ejenti engaphakathi kweseva noma kusevisi yamafu ephethwe.

I- WAF esekelwe kunethiwekhi ivame ukusetshenziswa njengethuluzi elibonakalayo noma elibonakalayo ngaphakathi kwengqalasizinda, phakathi kwe-inthanethi nezinhlelo zokusebenza. Lena indlela yakudala esetshenziswa abakhiqizi abanjengo-F5. Inikeza inzuzo yokusebenza okuphezulu kanye nokulawula okune-granular , kodwa ukucushwa kanye nokuphathwa kungaba nzima. Ukungena ngemvume kuvame ukuthunyelwa ku-syslog noma ku-SIEM ephakathi, futhi kubalulekile ukuhlunga ngokucophelela lokho okugciniwe ukuze ugweme ukulayisha ngokweqile amathuluzi okugcina nokuhlaziya, kanye nokuhlonza izinkinga kumanethiwekhi e-IP kanye ne-DNS.

Ama- WAF asekelwe ku-Host asebenza kumaseva afanayo (noma izitsha) lapho uhlelo lokusebenza lukhona, ngokuvamile njengemojuli noma i-ejenti (isibonelo, i-ModSecurity ehlanganiswe ne-Nginx noma i-Apache; ukuyihlanganisa nokuqina kwe-Linux kusetshenziswa i-SELinux kuthuthukisa ukuma kokuphepha). Lo modeli uvumela umongo omkhulu wohlelo lokusebenza kanye nemithetho ecacile kakhulu ngesevisi ngayinye, ngezindleko zokusebenzisa izinsiza zendawo futhi kudinga ukuphathwa kwelogi okusatshalaliswe kakhulu. Amalogi angagcinwa kumafayela endawo bese ethunyelwa, noma ahlanganiswe nezinsizakalo zokuloba ezihlanganisiwe.

Ama- WAF asekelwe efwini (i-Cloudflare, i-Akamai, i-Imperva Cloud, i-AWS WAF, njll.) ahlanganiswa nama-load balancers, ama-CDN, noma amanethiwekhi abonakalayo. Abahlinzeki bavame ukunikeza amadeshibhodi kanye nokuthumela amalogi ku-S3, i-BigQuery, ama-remote syslogs, noma ama-SIEM. Ngokuvamile kulula ukuwasetha, kodwa kufanele uvumelanise izinqubomgomo zakho zokubhalisa nemodeli yomhlinzeki: izinhlobo zemicimbi, izikhathi zokugcina, izihlungi zobunzima, njll.

Ukukhetha imodeli eyodwa noma enye akuyona nje isinqumo sobuchwepheshe, kodwa futhi kuyindaba yokuthi ufuna ukulinganisela kanjani ukuqopha nokukhiya: isevisi ephethwe yifu yenza kube lula izici eziningi, kodwa ungase ufune ukulawula ngokuphelele ukuthi amalogi agcinwa kuphi ngenxa yokuthobela imithetho noma izinqubomgomo zobumfihlo, ezikushukumisela ukuba uye kumamodeli asendaweni noma ahlanganisiwe.

Imigomo, imithetho kanye nama-ACL ewebhu: indlela i-WAF enquma ngayo ukuthi ivimbele, ivumele noma ibhalise kuphela

Kungakhathaliseki ukuthi umenzi ungubani, wonke ama-WAF anamuhla asekelwe emqondweni wezimo zokufinyelela, imithetho, kanye nezinqubomgomo . Ukuqonda lokhu kuyisihluthulelo sokusebenzisa ngempumelelo izindlela zokubala, zokuloba, kanye nezokuvala ekukhiqizeni.

Izimo zichaza ukuthi iyiphi ingxenye yesicelo ehlolwayo: i-IP yomthombo, izihloko ezithile ze-HTTP (Umphathi, I-User-Agent, Yamukela, Uhlobo Lokuqukethwe…), amapharamitha ombuzo, umzimba wesicelo, amakhukhi, indlela ye-HTTP, izwe lemvelaphi, njll. Isibonelo, ku-AWS WAF Classic ungachaza isimo se-IP esinamakheli noma amabanga afinyelela ku-10.000, noma isimo sokufanisa izintambo engxenyeni ye-URL.

Imithetho ihlanganisa imibandela eyodwa noma ngaphezulu bese inika inhloso: ukuvumela, ukuvimba, noma ukubala. Uma umthetho unemibandela eminingi, ngokuvamile ihlolwa nge - AND : yonke imibandela kumele ihlangatshezwe ukuze umthetho usebenze. Umthetho ojwayelekile ongenamibandela, empeleni, awuhambisani nalutho, futhi isenzo sawo asikaze sisebenze.

Ama-WAF amaningi, kufaka phakathi i-AWS WAF, nawo anemithetho esekelwe emananini . Le mithetho ibala izicelo ezivela ekhelini le-IP (noma isethi yamakheli e-IP ahlangabezana nezimo ezithile) ngesikhathi sesikhathi, isibonelo, imizuzu emihlanu. Uma umkhawulo udluliwe—ake sithi, izicelo eziyi-1.000 ngemizuzu emihlanu—umthetho uqala ukusebenza: ukuvimba noma ukubala nje. Lokhu kuwusizo kakhulu ku:

• Ukulawula amandla amakhulu kumafomu okungena ngemvume.
• Nciphisa ukuklwebha okunolaka noma ama-bot aluhlaza.
• Ukunciphisa izinhlobo ezithile zokuhlaselwa kwe-DDoS ezingeni lesicelo.

Izinga elilandelayo yi- Web ACL (Uhlu Lokulawula Ukufinyelela) . Lapha, imithetho ihlelwe ngamaqoqo, futhi i-oda lokuhlola kanye nesenzo esizenzakalelayo (ALLOW noma BLOCK) kuyachazwa. Isicelo sidlula emithethweni ngokulandelana; uma sifana nesinye, isenzo saso siyasetshenziswa, futhi ukuhlolwa kokunye kuyamiswa. Uma kungafani nanoma yimuphi umthetho, isenzo esizenzakalelayo esichazwe ku-ACL siyasetshenziswa.

Ngokuphathelene nokulinganisa ukuloga nokuvimba, i-ACL yilapho unquma khona ukuthi ufuna uhlelo luvumeleke ngokuzenzakalelayo (LUVUMELE futhi luvimbe kuphela ngemithetho ethile) noma lube nomkhawulo omkhulu (VIMBELA ngaphandle kwasezimweni ezingavamile). Ngaphezu kwalokho, izixazululo eziningi zikuvumela ukuthi usethe imithetho kwimodi "yokubala" ngaphakathi kwe-ACL, ukuze iloge ifane kodwa ayivimbeli ithrafikhi—ilungele isigaba sokulungisa.

Uhlu olugunyaziwe kanye nokunciphisa umsindo kumalogi

Uhlu lwabavunyelwe luyithuluzi eliyisisekelo lokunciphisa imiphumela emibi engamanga nomsindo ku-log . Umqondo ulula: kwezinye izimo, utshela i-WAF ukuthi ingasebenzisi isiqondiso noma isethi yemithetho kuthrafikhi ethile osuvele uyibeke njengethembekile noma owaziyo ukuthi ingaphandle kwenqubo evamile kodwa isemthethweni.

Isibonelo, ku-AWS WAF ungakha imithetho yohlu lwabavunyelwe ukuze uma isicelo sivela ekhelini elithile le-IP noma ububanzi , noma uma sifana nephethini ye-URL eyaziwayo kanye nendlela ye-HTTP, ukuhlolwa okuthile kwesiginesha akusetshenziswa. Lokhu kusiza:

• Vimbela ama-API angaphakathi asebenzisa amaphethini "angavamile" dala imiphumela emihle engamanga eqhubekayo.
• Nciphisa ukubambezeleka okulethwa ukuhlolwa okujulile kwethrafikhi osuvele uyibheka njengethembekile.
• Nciphisa inani lamarekhodi angadingekile kumalogi e-WAF.

Kumapulatifomu afana ne-ModSecurity, indlela enconywayo akuyona ukushintsha imithetho ejwayelekile (isb., i-OWASP Core Rule Set), kodwa ukudala okukhishwe okuthile nge-ID yomthetho kumapharamitha athile, izindlela, noma abasebenzisi. Lokhu kukuvumela ukuthi ugcine ukuvikelwa okuphelele ngaphandle kokudala ubuthakathaka obukhulu ngokukhubaza imithetho yonke kusayithi.

Isihluthulelo ukwenza uhlu lwabavunyelwe luhlinzwe , hhayi indlela ebanzi. Kungcono kakhulu ukukhipha inhlanganisela ethile (umthetho X + ipharamitha Y ku-URL Z) kunokukhubaza umthetho X emhlabeni jikelele. Ngaleyo ndlela, ukuloga kuhlala kuwusizo futhi awudali izindawo ezingadingekile.

Imithetho nemikhawulo yephrothokholi: nini ukuvimba, nini uxwayisa

Ama-WAF amaningi afaka isethi yemithetho yokuhlanza iphrothokholi ye-HTTP esebenza njengesihlungi sokuqala sethrafikhi engalungile noma esolisayo . Le mithetho ihlola izihloko ezidingekayo, izindlela, osayizi bempikiswano, njll., futhi iwumthombo ovame ukuvikeleka okuhle kanye nokuhle okungamanga uma kungaqondakali kahle.

Ezinye izibonelo ezivame kakhulu:

• Isihloko Sokwamukela Asikho (Isihloko Sokwamukela Esingekho): Lokhu akuyona nje ukwephulwa kwe-RFC, kodwa izicelo eziningi ezingenalo leli sihloko zivela kumathuluzi azenzakalelayo noma izikripthi ezibhalwe kabi. Kungathinta ama-API enziwe ngokwezifiso noma amaklayenti angawathumeli. Ezindaweni eziningi, ukuloga nokubala kuyathandwa kunokuvinjelwa okuqondile.
• Isihloko Somsingathi EsingekhoNgokwezindinganiso ze-HTTP/1.1, i-Host header iyimpoqo. Ama-WAF ayayidinga futhi ukuze anqume ukuthi iyiphi inqubomgomo okufanele isetshenziswe. Ukuvimba lapha kuvame ukuba nengqondo, kodwa kungadala imiphumela engamanga ngesikhathi sokuhlola noma ngenxa yethrafikhi yangaphakathi engalungiselelwanga kahle; kuyalulekwa ukuqapha amalogi ngaphambi kokuvumela ukuvimba okuqinile.
• Isihloko se-User-Agent esingekhoLo mthetho uzama ukuvimbela ama-bot ayisisekelo kanye nethrafikhi engaziwa. Inkinga ukuthi ama-API amaningi asemthethweni angase angathumeli i-User-Agent. Indlela enengqondo kakhulu ngokuvamile iwukungena ngemvume, futhi uma kutholakala i-API ehambisanayo nesemthethweni, engeza i-IP noma iphethini yabo ohlwini lokuvumela.
• Ukuqinisekiswa kwe-GET/HEAD ngomzimbaNakuba i-RFC ingakuvimbeli ngokuqinile ukuthumela umzimba ngezicelo ze-GET noma ze-HEAD, akuyona into evamile futhi kungase kubonise imizamo yokubalekela. Ezimweni eziningi, isinyathelo sokuqala ukubhala zonke lezi zicelo futhi, uma kutholakala ukuthi ziyiziphambeko ezisolisayo, qhubeka nokuzivimba.
• Uhlobo Lokuqukethwe Olungekho nomzimbaUma kukhona umzimba kodwa kungekho Uhlobo Lokuqukethwe, kuyinkomba ecacile yokusetshenziswa kwephrothokholi okungafanele noma ukuzama ukugwema ukuhlaziywa. Kulezi zimo, indlela yokuvimba enolaka ivame ukuba nengqondo, ikakhulukazi ezindaweni ezibhekene ne-inthanethi.

Ngaphezu kwale mithetho yephrothokholi, imikhawulo yempikiswano ivame ukutholakala ivikela ezikhukhuleni ezingeni lesicelo kanye nokuhlaselwa kwe-DoS. Isibonelo:

• Inani eliphezulu lama-agumenti ngesicelo ngasinye (ngokuzenzakalelayo, angu-255 kwamanye ama-WAF).
• Ubude obukhulu bempikiswano ngayinye (isibonelo, izinhlamvu ezingu-400).
• Usayizi ohlanganisiwe wazo zonke izimpikiswano (isibonelo, amabhayithi angu-64.000).

Lezi zindinganiso zinengqondo ezinhlelweni eziningi zokusebenza, kodwa kunezimo—ukulayisha amafomu okuyinkimbinkimbi, izihlungi ezithuthukisiwe, imithwalo emikhulu ye-JSON—lapho kuvela khona imiphumela engamanga. Kulezo zimo, indlela ehlakaniphile kakhulu ukuqala ngokufaka ilogi nokubala , ubuyekeze ukuthi yimaphi amaphuzu okuphela aphula imikhawulo, bese ulungisa kuphela leyo mizila, kunokuphakamisa yonke imikhawulo yesayithi lonke.

Izinto ezinhle ezingamanga: indlela yokuzibona futhi ungafi uzama

I-positive engamanga iyisicelo esisemthethweni i-WAF esisibona njengesinonya futhi sivimbe noma sihlase njengokuhlasela. Azinakugwenywa, ikakhulukazi uma unezimiso eziphelele ezifana ne-OWASP CRS ezivuliwe, kodwa zingaphathwa ngobuchwepheshe ukuze zingabi yikhanda elibuhlungu nsuku zonke.

Ukuthola imiphumela emihle engamanga kuqala ngokubuyekezwa ngokucophelela kwamalogi . Lokhu kuhilela ukuhlola ukuthi yiziphi izicelo ezivinjiwe, ukuthi yimiphi imithetho ezibangela, kanye nomongo lapho zivela khona (i-URL, amapharamitha, umsebenzisi, imvelaphi, njll.). Amathuluzi abonakalayo namadeshibhodi angasiza ekuboneni ama-spikes kumaphutha angu-403 noma amaphethini angavamile.

Indlela enconywe kakhulu, kokubili ngabahlinzeki bamafu kanye nomphakathi we-ModSecurity, ukusebenzisa imodi yokulingisa noma yokubala . Kule modi, imithetho ofuna ukuyihlola ifaka irekhodi ngalinye elihambisanayo kodwa ungayivimbi. Lokhu kukuvumela ukuthi ubone, isibonelo, ukuthi zingaki izicelo ezisemthethweni umthetho omusha we-SQLi obewungazivimba ngaphambi kokuthi ulwele ukuwusebenzisa ekukhiqizeni.

Kungumqondo omuhle futhi ukuhlola imithetho endaweni yokubeka noma yokukhiqiza ethola ithrafikhi yangempela noma elingisiwe. Amathuluzi afana ne-OWASP ZAP noma izikripthi zokuphinda ithrafikhi zingakusiza ukuthi ulingise amaphethini asemthethweni kanye nokuhlaselwa okwaziwayo ukuhlola ukuziphatha kwe-WAF.

Ngaphezu kwalokho, kubalulekile ukucabangela umthelela wokusebenza kanye nodumo lwezinzuzo ezingamanga: ukuphazamiseka kokukhokha, ukwehluleka kokubhaliswa kwabasebenzisi, izingcingo ze-API ezibalulekile ezingaphumeleli ngaphandle kwencazelo—konke okungaba nezindleko eziqondile emalini engenayo kanye nesithombe somkhiqizo. Ukweqisa kwezinzuzo ezingamanga nakho kuqedela ithimba lezokuphepha ngezexwayiso ezingangezi inani, okwenza kube nzima ukuhlonza izehlakalo zangempela.

Amasu okulungisa imithetho kanye nokusetshenziswa ngobuhlakani kwerejista

Ukuphatha imiphumela emibi engamanga akukhona ukuvala imithetho kuze kube yilapho "konke kusebenza kahle," kodwa kumayelana nokulungisa i-WAF ngokunemba kokuhlinzwa . Yilapho imikhuba emihle efana nale elandelayo iqala khona ukusebenza:

Okokuqala, gwema ukukhubaza imithetho emhlabeni jikelele. Kungcono ukudala okuhlukile okuqondile kakhulu : khipha i-ID yomthetho kuphela yomzila othile, kumapharamitha athile, noma ithrafikhi yangaphakathi. Ngale ndlela, uhlala uvikelekile kulo lonke uhlelo lokusebenza futhi ugcina amalogi awusizo.

Okwesibili, sebenzisa imodi yokubala ngaphambi kokuvimba. Ukusebenzisa imithetho emisha ekuqaleni kuphela kumodi yokungena ngemvume kukuvumela ukuthi ulinganise ukuthi zingaki izicelo ezisemthethweni ezizothinteka. Ungagcwalisa lokhu ngezexwayiso ku-SIEM ukuze uthole ngokushesha ukuthi umthetho udala inani elingavamile lokufana.

Okwesithathu, hlanganisa i-WAF ne -SIEM noma ipulatifomu yokungena ngemvume ephakathi . Lokhu kwenza kube lula ukuhlanganisa imicimbi ye-WAF nezinye izinkomba: umsebenzi wesistimu ongavamile, ukwehluleka kokuqinisekisa ngobuningi, izinguquko zokucushwa ezisolisayo, njll. Kuphinde kusize ukubeka phambili imithetho okufanele ilungiswe kuqala ngokusekelwe ebunzimeni kanye nokuvama kwemicimbi.

Okwesine, bhala phansi zonke izinguquko: yimuphi umthetho olungiswe kahle, yimuphi umphumela, ngaphansi kwaziphi izizathu, futhi ngabuphi ubufakazi. Ukubonisana namabhukwana eseva kungaba usizo kulokhu. Lo mbhalo awusizi nje kuphela ekugcineni ukulawula kwangaphakathi, kodwa futhi ubaluleke kakhulu ekuhlolweni nasekubuyekezweni kokuphepha, lapho ufuna ukukhombisa ukuthi izilawuli azikhutshazwa kalula.

Ukuzenzakalela, ukufunda komshini, kanye nemithetho eguquguqukayo ku-WAF

Njengoba izinhlelo zokusebenza zikhula futhi ithrafikhi iba nzima kakhulu, ukuphatha i-WAF ngesandla kuba yinto engenakwenzeka. Yilapho ukwenza ngokuzenzakalelayo, ukuhlaziywa kwamalogi okuthuthukisiwe, kanye, kwezinye izimo, ukufunda komshini kudlala khona indima.

Okokuqala, ukuhlanganiswa ne-SIEM kukuvumela ukuthi wakhe imithetho yokuhlobana kanye nezimpendulo ezenzakalelayo : isibonelo, uma isethi yama-IP ivuselela ngokuphindaphindiwe imithetho yokujova noma ye-XSS, ungakha isenzo esizenzakalelayo sokwengeza lawo ma-IP ohlwini lwesikhashana noma ukuqinisa izinga lokuhlola.

Okwesibili, amanye ama-WAF afaka izindlela zokufunda komshini eziqaphela ithrafikhi esemthethweni esikhathini esibekiwe. Ngokusekelwe kulolu lwazi, aphakamisa noma alungise imikhawulo, amaphethini, kanye namaphrofayili okuziphatha okuvamile. Lokhu kusiza ukunciphisa imiphumela engamanga lapho imithetho ishintshelwa kwimodi yokuvimba futhi ibona ukuphambuka kwethrafikhi okulandelayo.

Ezindaweni zocwaningo kanye nezindawo zelebhu, amasu okufunda aqondisiwe asetshenziswe ukuqeqesha amamodeli ahlukanisa phakathi kwethrafikhi evumelekile neyingozi, ukucwenga izinqubomgomo ezisetshenziswa ekukhiqizeni. Nakuba kungeyona inhlamvu yomlingo, le ndlela ingasiza ekutholeni amaphethini angabonakali kalula imithetho yakudala esekelwe esiginesha.

Okokugcina, ukuhlola okuzenzakalelayo okuqhubekayo (ukusebenzisa amathuluzi afana ne-OWASP ZAP, izikripthi ezenziwe ngokwezifiso, noma amapayipi e-CI/CD) kukuvumela ukuthi uqinisekise ukuthi izinguquko ku-WAF aziphuli ukusebenza okubalulekile noma zishiye ubuthakathaka obusobala. Ukuhlanganisa lezi zivivinyo emjikelezweni wokufakwa kwenza ukuphepha kube yingxenye yemvelo yokugeleza kokuthuthukiswa, kunokuba kube yi-patch yomzuzu wokugcina.

Ukwakhiwa kwenqubomgomo ngesicelo ngasinye kanye nohlu olumnyama ngesevisi ngayinye

Ezindaweni eziyinkimbinkimbi—isibonelo, umhlinzeki we-hosting noma i-ISP—inqubomgomo eyodwa ye-WAF ayanele, ikakhulukazi uma kuhileleke i-shadow IT . Kuvamile ukuba nezizinda eziningi noma izinhlelo zokusebenza ngemuva kwe-load balancer efanayo, ngayinye inezidingo zokuphepha ezahlukene kanye namaphrofayili ethrafikhi . Yilapho ukuklama izinqubomgomo nezinhlu ezithile zesevisi kuba yinto ebalulekile.

Isibonelo esibonakalayo i-HTTP/S load balancer esebenza njengommeleli ophambene wamasayithi amaningi (isb., www.company1.com kanye ne-www.company2.com) ngemuva kwekheli elilodwa le-IP elibonakalayo. Kulesi simo, i-WAF ingalungiselelwa ukuhlola i-Host header kanye nekheli le-IP lomthombo ngokushesha nje lapho isicelo sifika, ngisho nangaphambi kokuba sifinyelele kumojuli yokulinganisela umthwalo.

I-logic ingaba yinto efana nale: i-WAF ihlola ukuthi inhlanganisela ye- SERVER_NAME (Host) kanye ne-IP yeklayenti ifana yini nohlu olumnyama oluqondene nesayithi. Uma i-IP ibhalwe njengevinjelwe ku-www.company2.com kodwa hhayi ku-www.company1.com, impendulo engu-403 Forbidden ithunyelwa kuphela esimweni sokuqala. Ithrafikhi "ehlanzekile" ibe isidluliselwa kumojuli yokulinganisela umthwalo, enquma ukuthi iyiphi i-backend ekhonza isicelo.

Lokhu kuvumela ukugcina, isibonelo, uhlu olumnyama oluqondene nesizinda , esikhundleni sohlu olulodwa lomhlaba wonke lwalo lonke iphuzu lokufinyelela. Ezingeni lokungena, ukwenqatshwa ngakunye kuqoshwa ku-syslog ngemininingwane efana ne-ID yomthetho, isimo esifanisiwe, i-URL, umsingathi, kanye nekheli le-IP leklayenti, okwenza kube lula ukuhlaziya okulandelayo kanye nokwandiswa noma ukulungisa amaphutha kwalolu hlu.

Imfundiso yale ndaba ukuthi lapho izinqubomgomo zakho zihlukaniswa kakhulu (ngokusebenzisa, ngokwemvelo, ngohlobo lomsebenzisi), kulapho ungalinganisa khona kahle phakathi kokungena ngemvume nokuvimba: ungaba lukhuni kakhulu kuma-portal okuphatha futhi uvumelane nezimo kumawebhusayithi olwazi, isibonelo, njalo unobufakazi kuma-log bokuthi kungani kwenziwa isinqumo ngasinye.

Ngale kwe-WAF yakudala: ukuvikelwa kwe-WAAP ne-API

Isimo sosongo asikami ndawonye. Namuhla, izinhlelo zokusebenza eziningi zivela efwini, zisebenzisa ukwakheka kwezinsizakalo ezincane, futhi zidalula ama-API omphakathi nawangasese , okwenza abe yizinhloso eziyinhloko zabahlaseli. Ama-WAF endabuko aguqukele kumapulatifomu abanzi aziwa ngokuthi i-WAAP (Isicelo Sewebhu kanye Nokuvikelwa Kwe-API) noma i-WAAS (Isicelo Sewebhu kanye Nokuphepha Kwe-API).

Lezi zixazululo azigcini nje ngokuthola izinhlelo zokusebenza zewebhu ngokuzenzakalelayo, kodwa futhi zikhomba ama-endpoints e-API , zamukele imininingwane efana ne-OpenAPI noma i-Swagger, futhi zisebenzisa leyo ncazelo ukuhlola ukuhambisana kwezicelo: izinhlobo zedatha ezilindelekile, amapharamitha avunyelwe, imikhawulo yosayizi, njll. Kuye nge-endpoint (isibonelo, ephatha idatha ebucayi kakhulu), izinga eliphezulu kakhulu lokuhlola nokuvimba lingasetshenziswa.

Ezingeni logging, i-WAAP ivame ukukhiqiza imicimbi ecebile ngomongo : ukuthi iyiphi indawo yokugcina ye-API ehlaselwe, yimuphi umsebenzi (GET, POST, PUT…), yimuphi umsebenzisi noma ithokheni ehilelekile, iyiphi ingxenye yencazelo ephuliwe, njll. Lokhu kuvumela izinqumo zokuvimba ezinembile kakhulu, kunokuthembela kuphela kumaphethini okulayisha ajwayelekile.

Ngaphezu kwalokho, amathuluzi amaningi e-WAAP afaka phakathi ukuvikelwa kwe-DoS okuqondene nohlelo lokusebenza kanye ne-API, ukuhlunga indawo, ukuphathwa kwedumela le-IP, ukutholwa kwe-bot kanye nokuskena, kanye nezinketho zokwenza ngokwezifiso amazinga ezexwayiso ngesevisi ngayinye. Futhi, kumayelana nokuba nokuguquguquka kokunquma ukuthi ufuna indlela eqinile kuphi nokuthi ufuna ukubeka kuphi ukusebenza okubushelelezi , ngaphandle kokudela isizindalwazi esiqinile selogi sokuphenya noma yiziphi izehlakalo.

Uma kuhlanganiswa, i-WAF ehlelwe kahle—kungakhathaliseki ukuthi yakudala, esekelwe ku-WAAP, noma ehlanganiswe ohlelweni lwe-cloud—iba yingxenye ebalulekile yohlelo lokusebenza lwesimanje kanye nokuvikela i-API, ekwazi ukuhlanganisa ukuqopha okuningiliziwe, ukuvimba okuhlakaniphile, kanye nokuzivumelanisa okuqhubekayo nesimo sengozi esishintshayo.