Ukutholwa okuhlala kuvuliwe ku-firewall yohlelo lokusebenza lwewebhu

Informatec Digital » Izinsiza » Ukutholwa okuhlala kuvuliwe ku-firewall yohlelo lokusebenza lwewebhu

Ukuphepha kwewebhu akuseyona nje into yokufaka isofthiwe yokulwa namagciwane nokulindela okuhle kakhulu. Namuhla, izinhlelo zokusebenza zewebhu nama-API asenhliziyweni cishe yawo wonke amabhizinisi , okwenza kube yizisulu eziyinhloko zokuhlaselwa. Kusukela ezitolo eziku-inthanethi kuya kuma-digital banking kanye namapulatifomu e-SaaS, konke kusebenza phezu kwe-HTTP kanye ne-HTTPS—okuyilapho kanye ama-firewall ezinhlelo zokusebenza zewebhu aqala khona ukusebenza.

I-WAF yesimanje yenza okungaphezu nje kokuhlunga ithrafikhi: inikeza ukutholwa okuhlala kuvuliwe ku-firewall yohlelo lokusebenza lwewebhu , ilungisa imithetho yayo ngesikhathi sangempela, ihlangana nezinye izendlalelo zokuzivikela, futhi isiza ukuhambisana nemithetho efana ne-PCI DSS noma i-GDPR. Isihluthulelo ukuqonda ngokugcwele ukuthi yenzani, isebenza kanjani, ukuthi yimaphi amamodeli akhona, nokuthi ungayisebenzisa kanjani ngaphandle kokubeka engcupheni ukusebenza noma ulwazi lomsebenzisi.

Iyini i-WAF futhi kungani ibaluleke kangaka namuhla?

I-firewall yesicelo sewebhu (i-WAF) iyindlela yokuphepha ekhethekile esesigabeni sesi-7 semodeli ye-OSI, eyenzelwe ukuqapha, ukuhlunga, nokuvimba ithrafikhi ye-HTTP ne-HTTPS engena futhi iphuma kuhlelo lokusebenza lwewebhu noma i-API. Ngokungafani ne-firewall yendabuko, evikela inethiwekhi iyonke (izendlalelo 3 no-4), i-WAF ihlala phakathi kweklayenti nohlelo lokusebenza futhi iyaqonda umongo wezicelo zewebhu.

Umsebenzi wayo oyinhloko ukuvimba ukuhlaselwa okuxhaphaza ubuthakathaka ngaphakathi kohlelo lokusebenza ngokwalo : ukujova kwe-SQL, ukubhala nge-cross-site (XSS), ukukhohlisa kwesicelo se-cross-site (CSRF), ukuxhashazwa kokuqinisekisa, imizamo yamandla amakhulu, ukuxhashazwa kwamaphutha e-cryptographic noma okulawula ukufinyelela, njll. Eziningi zalezi zinsongo zifakiwe ku-OWASP Top 10 edumile, okusalokhu kuyisilinganiso semboni emashumini eminyaka kamuva.

Lolu hlobo lwe-firewall lunganikezwa njengedivayisi ebonakalayo, isofthiwe efakwe kumaseva, noma isevisi yamafu . Kungakhathaliseki ukuthi imodeli injani, umqondo uyafana: ukuhlola isicelo ngasinye se-HTTP/HTTPS, ukusiqhathanisa nesethi yezinqubomgomo zokuphepha, bese unquma ngama-millisecond ukuthi uzovumela, uvimbele, noma uphonsele inselelo iklayenti (isibonelo, nge-captcha noma inselelo ye-JavaScript).

Endaweni lapho izinhlelo zokusebenza zikhishwa ngokushesha, ngezingxenye zomthombo ovulekile kanye nokusetshenziswa okuqhubekayo, kuvamile ukuthi kube khona ubuthakathaka ekukhiqizweni ngaphambi kokuba bulungiswe . Yilapho i-WAF isebenza khona njenge-"airbag": ayilungisi ikhodi, kodwa ingavimbela ukuhlaselwa ekuyisebenziseni kabi.

Izinsongo ezinkulu ezivinjelwa yi-firewall yohlelo lokusebenza lwewebhu

I-WAF elungiselelwe kahle inganciphisa uhla olubanzi lokuhlaselwa kwezinhlelo zokusebenza nama-API . Ezinye zezindlela ezivame kakhulu yilezi:

• Ukufakwa kwe-SQL (i-SQLi)Umhlaseli uzama ukufaka imiyalo ye-SQL kumafomu noma kumapharamitha ukuze afunde, aguqule, noma asuse idatha kusuka kusizindalwazi.
• Imibhalo Yesiphambano Yesayithi (XSS)Lokhu kuhilela ukufaka izikripthi ezinonya emakhasini ewebhu ukuze kusetshenziswe ikhodi ezipheqululini zabanye abasebenzisi.
• I-Cross-Site Request Forgery (CSRF)Umsebenzisi ukhohliswa ukuba athumele izicelo ezingafuneki kuhlelo lokusebenza lapho esevele engene khona.
• Ukuhlaselwa ngamandla okunonya kanye nokugcwaliswa kweziqinisekisoAmaphasiwedi noma inhlanganisela yegama lomsebenzisi/iphasiwedi ihlolwa kuze kube yilapho iphumelela, ngokuvamile ngendlela enkulu nezenzakalelayo.
• Ukugcwala kwe-buffer kanye nokusetshenziswa kobuthakathaka beseva: amaphethini okufaka angajwayelekile afuna ukuphula ingqondo noma inkumbulo yohlelo lokusebenza.
• I-DDoS yezinga lohlelo lokusebenza: gcwalisa ama-URL noma ama-endpoint athile anezicelo zokuqeda izinsiza zohlelo lokusebenza.

Ngaphezu kwalokho, ama-WAF anamuhla afaka phakathi amakhono okuthola nokumisa ithrafikhi ye-bot enonya (ukuklwebha okunolaka, ukungena ngemvume okuzenzakalelayo, ukuthenga amathikithi amaningi, njll.) kusetshenziswa amasu anjengokuqinisekiswa kwe-JavaScript, i-CAPTCHA, ukuhlaziywa kokuziphatha, noma ukuhlonza idivayisi.

Indlela ukutholwa okuhlala kuvuliwe okusebenza ngayo ku-WAF

Ukusebenza kwangaphakathi kwe-WAF kusekelwe enjinini yokuhlola ithrafikhi ye-HTTP/HTTPS ejulile kanye nesethi yezinqubomgomo noma imithetho. Isicelo ngasinye sihlaziywa emazingeni amaningana ukuze kutholakale indawo yaso:

Ngakolunye uhlangothi, kunemithetho echazwe ngaphambilini , evame ukusekelwe kumasethi ajwayelekile njenge-OWASP ModSecurity Core Rule Set noma ama-proprietary equivalents. Le mithetho ihlanganisa amasignesha okuhlasela aziwayo (amaphethini ajwayelekile okujova kwe-SQL, i-XSS, i-path traversal, njll.).

Ngakolunye uhlangothi, ukutholwa okuhlala kuvuliwe kuncike ezindleleni zokuhlaziya ezithuthukisiwe kakhulu :

• Izinkulumo ezijwayelekile ukuthola amaphethini asolisayo ngaphakathi kwamapharamitha, izihloko, imizimba, kanye nezindlela.
• Amamodeli okulinganisa ubungozi ezinikeza "isilinganiso sengozi" ngokuhlanganisa izimpawu eziningi ezivela esicelweni ngasinye.
• I-SmartParse kwezakhiwo eziyinkimbinkimbi (i-JSON, i-XML, imithwalo ekhokhwayo ebhalwe phansi) ukuhlonza ukuhlaselwa okufihliwe phakathi kwedatha esemthethweni.
• ukuhlaziywa kokuziphatha kanye nokuxhumana kwethrafikhi yomlando ukuhlukanisa ukuziphatha okuvamile kumaphethini okuhlasela angabonakali.

Ngakho konke lokhu, i-WAF ingasebenzisa izinqubomgomo ngesikhathi sangempela: ukuvumela, ukuvimba, ukubhalisa, noma ukuphikisa isicelo . Ngaphezu kwalokho, iqopha imicimbi ngamalogi anemininingwane angathunyelwa epulatifomu ye-SIEM noma ye-SOAR ukuze kuhlotshaniswe, kuhlolwe, futhi kuphendulwe ngokuzenzakalelayo.

Iphuzu elibalulekile ukuthi ukutholwa akuhlali njalo. I-WAF esebenzayo inezibuyekezo eziqhubekayo zemithetho kanye nezisayini ukuze ivumelane nobuthakathaka obusha kanye namasu okugwema, futhi eziningi zifaka ukufunda komshini kanye nobuhlakani bokusongela obusekelwe efwini ukuze kuthuthukiswe ukutholwa ngaphandle kokungenelela okuqhubekayo ngesandla.

Amamodeli okuphepha: uhlu olumnyama, uhlu olumhlophe, kanye ne-hybrid

Ukuziphatha kwe-firewall yohlelo lokusebenza kungachazwa ngezindlela ezintathu eziyinhloko zokuphepha:

• Imodeli yokuphepha engalungile (uhlu olumnyama)Izicelo zivunyelwe ngokuzenzakalelayo, ngaphandle kwalezo ezihambisana neziginesha noma amaphethini ahlukaniswe njengezinonya.
• Imodeli yokuphepha efanele (uhlu olumhlophe)Konke okungavunyelwe ngokusobala kuvinjelwe; izicelo ezihlangabezana nephrofayili ethile "yethrafikhi enhle" kuphela ezivunyelwe ukudlula.
• Imodeli ye-HybridZombili lezi zindlela ziyahlanganiswa, kusetshenziswa abamhlophe emisebenzini ebalulekile kanye nabamnyama kuyo yonke ithrafikhi.

Ukufakwa ohlwini oluyimfihlo ngokuvamile kuphephile kakhulu kodwa futhi kudinga kakhulu ukulungiselelwa , njengoba kudinga ukuqonda okuphelele kokuthi yini edala ithrafikhi esemthethweni. Ukufakwa ohlwini oluvinjelwe kulula ekuqaleni, kodwa kungashiya izikhala zokuhlaselwa kwezinsuku ezingenalutho noma amasu amasha. Ngakho-ke, ama-WAF amaningi anamuhla akhetha indlela ehlanganisiwe, elungisekayo ngesicelo ngasinye noma i-endpoint.

Izinhlobo zama-WAF ngokuya ngokusetshenziswa kwawo

Kuye ngokuthi zifakwe kuphi futhi kanjani, singahlukanisa izinhlobo eziningana zama-firewall ohlelo lokusebenza lwewebhu, ngalinye linezinzuzo kanye nokungalungi kwalo ngokwezindleko , ukulawula, ukubonakala, kanye nokusebenza :

• Ama-WAF asekelwe kunethiwekhi (ihadiwe): amadivayisi angokoqobo abekwe engqalasizinda yenethiwekhi, phakathi kwe-inthanethi namaseva ohlelo lokusebenza.
• Ama-WAF asekelwe ku-Host noma asekelwe kusofthiweZifakwe ngqo ku- amaseva lapho uhlelo lokusebenza lusebenza khona, noma njengemojuli ehlanganiswe esitaki sohlelo lokusebenza.
• ama-WAF asekelwe efwini: ezinikezwa njengesevisi ngumhlinzeki wefu noma we-edge/CDN, zivame ukulungiselelwa ngokushintsha izilungiselelo ze-DNS noma ze-proxy.
• Ukuthunyelwa kwe-hybridBahlanganisa ama-WAF endawo (asezindaweni noma kumphathi) nama-WAF asekelwe efwini ukuze amboze izindawo ezixubile, ezindala, kanye nezasendaweni yamafu ngasikhathi sinye.

Amadivayisi enethiwekhi anikeza ukubambezeleka okuphansi kanye nokulawula kwendawo okubanzi , kodwa adinga ukutshalwa kwezimali kuhadiwe kanye nokugcinwa. Ama-Host WAF ahlinzeka ngokubonakala okuhlanganisiwe kuhlelo lokusebenza, yize esebenzisa izinsiza zeseva futhi adinga ukuphathwa okwengeziwe. Izinsizakalo zamafu zivelele ngokukhula kwazo, ukuthunyelwa okusheshayo, kanye nokulula kokugcinwa, yize zidela ukulawula kwangaphakathi futhi, kwezinye izimo, umongo ogcwele wazo zonke izinsongo.

I-WAF uma iqhathaniswa nezinye izinhlelo zokuphepha: i-NGFW, i-IPS kanye nezingodo zomlilo zendabuko

Kuvamile ukudideka indima ye-WAF namanye amadivayisi okuphepha. Ngayinye inendima yayo ekwakhiweni kwezakhiwo:

I -firewall yendabuko ichaza umngcele phakathi kwenethiwekhi yangaphakathi neyangaphandle, ilawula amachweba, amakheli e-IP, kanye namaphrothokholi ezingeni eliphansi. Ayiqondi ukuthi izinhlelo zokusebenza zewebhu zinengqondo kangakanani, noma okuqukethwe kwamafomu noma ama-URL.

I -firewall yesizukulwane esilandelayo (i-NGFW) yandisa le modeli yakudala ngokungeza ukuhlolwa okujulile kwephakethe, ukulawula komsebenzisi nohlelo lokusebenza, i-antivirus, i-antimalware, kanye nokuhlanganiswa kobuhlakani bezingozi. Amanye ama-NGFW afaka amakhono e-WAF, kodwa ukugxila kwawo kuhlala kunethiwekhi, kanti i-WAF igxile ngokuphelele kungqimba lohlelo lokusebenza.

Ngakolunye uhlangothi, uhlelo lokuvimbela ukungena (i-IPS) luhlaziya yonke ithrafikhi yenethiwekhi, kuzo zonke izinqubo, ukuze kutholakale amaphethini okuhlasela ajwayelekile. Ngokuvamile luthembela kumasignesha nemithetho engeyona ingqikithi njengenganekwane yohlelo lokusebenza lwewebhu (i-WAF), futhi aluhlali lungena ngokujulile ku-semantics ye-HTTP noma ku-logic yebhizinisi yohlelo lokusebenza.

Empeleni, ukwakheka okuqinile kuhlanganisa i-NGFW, i-IPS, ne-WAF , ngayinye ekhethekile kungqimba yayo, yondla i-SIEM ephakathi ehlobanisa imicimbi, ikhiqize izexwayiso, futhi ivumele impendulo ehlelekile, futhi izixhumanise namathuluzi okuphepha ukuze zenze ukuphathwa kube ngokuzenzakalelayo.

Izindlela zokufaka i-WAF kusakhiwo sohlelo lokusebenza

Ngaphezu kohlobo lwesisombululo, udinga ukunquma ukuthi i-WAF ihlanganiswe kanjani nokugeleza kwethrafikhi kohlelo lokusebenza . Izindlela ezivame kakhulu yilezi:

• Ibhuloho elibonakalayoI-WAF itholakala ku-inthanethi, ixhunywe kumachweba afanayo nohlelo lokusebenza, ngaphandle kokuthi amaklayenti noma amaseva "ayibone" ngokusobala.
• Ummeleli obuyela emuva obonakalayoIzinhlelo zokusebenza ziyazi nge-WAF, kodwa kuklayenti kubonakala sengathi zikhuluma ngqo nohlelo lokusebenza.
• Ummeleli ophambene ocacileAmaklayenti ayazi ukuthi axhuma ku-proxy, yona edlulisela izicelo kumaseva angaphakathi.

Imodi yebhuloho ivame ukuba lula kakhulu ukuyisebenzisa ngoba idinga izinguquko ezimbalwa zokucushwa, kodwa inikeza ukuhlukaniswa okuncane phakathi kohlelo lokusebenza kanye ne-firewall . Ukunambitheka okuhlukile kwe-proxy okuphambene kunikeza ukuhlukaniswa okungcono kohlelo lokusebenza, kwenza kube lula ukulayisha i-TLS, kuvumela ukuhlolwa kwethrafikhi ebethelwe, futhi kunikeza ukuguquguquka okwengeziwe ekusebenziseni imithetho ethuthukisiwe noma i-logic yokulinganisela umthwalo.

Izinzuzo ezibalulekile zokusebenzisa i-firewall yohlelo lokusebenza lwewebhu

Ukwamukela i-WAF ehlelwe kahle kunikeza izinzuzo ezicacile kokubili emazingeni obuchwepheshe kanye nawebhizinisi. Phakathi kwezinto ezibaluleke kakhulu yilezi:

• Ukuvikelwa okuthuthukisiwe ekuhlaselweni okuqondene nohlelo lokusebenzaokuyinto i-firewall yenethiwekhi noma i-IPS elula engenakukwazi ukuyivimba ngokunemba okufanayo.
• Ukunciphisa ingozi yokwephulwa kwedatha kanye nokungasebenzi kahle kwezinsizakaloukugwema izindleko eziqondile (ukumiswa, ukuhlenga, izinhlawulo) kanye nezindleko ezingaqondile (umonakalo wedumela, ukulahlekelwa ukwethenjwa).
• Usizo ngokuthobela imithethoikakhulukazi ezidingweni ezifana ne-PCI DSS, ezidinga ukuvikelwa kwezinhlelo zokusebenza ezigxile kwi-inthanethi kanye nobufakazi bokuqapha nokuvimba izinsongo.
• Ukunwebeka nokuvumelana nezimoikakhulukazi kumamodeli efu kanye nama-edge, avumela ukumunca ukuphakama kwethrafikhi kanye nemithwalo eguquguqukayo ngaphandle kokuklama kabusha yonke ingqalasizinda.

Abahlinzeki abaningi bokusingathwa kochwepheshe banikeza i-Web Application Forum (WAF) ehlanganiswe nepulatifomu yabo. Lokhu kwenza inqubo ibe lula, kuhlinzekwe iwebhusayithi noma uhlelo lokusebenza ngokunciphisa okuzenzakalelayo ngokumelene nokufakwa, ukubhala nge-cross-site (XSS), ukuhlaselwa okuyisisekelo kwe-DDoS, kanye nokusetshenziswa kabi kokuqinisekisa kusukela ekuqaleni, ngaphandle kokufuna ithimba ukuthi lidale imithetho eyinkimbinkimbi kusukela ekuqaleni.

Izinselele zangempela lapho kusetshenziswa i-WAF nokuthi ungabhekana kanjani nazo

Ukuthi nje i-WAF inamandla akusho ukuthi konke kuzohamba kahle. Kunezinselele eziningana okufanele uzikhumbule ukuze ukutholwa okuhlala kuvuliwe kungabi yinkathazo eqhubekayo :

• Okuhle okungamangaLena inkinga evamile. Umthetho ongalungiswanga kahle ungavimba ithrafikhi esemthethweni, wephule ukugeleza kokuthenga, noma uvimbele i-API ukuthi isebenze ngendlela efanele.
• Isidingo sokuvuselelwa okuqhubekayoUma izinkampani kanye nezinqubomgomo zingathuthukiswanga, i-WAF izohlala ingaziboni izindlela ezintsha zokuhlasela.
• Ubunzima bokucushwaUkuchaza imithetho emihle, ukuqonda izingodo, kanye nokulungisa izinqubomgomo kudinga ulwazi olukhethekile.
• Umthelela ekusebenzeniUkuhlolwa ngakunye kwengeza umthwalo. Umklamo ongemuhle noma indawo embi kungabangela ukubambezeleka okuphezulu.
• Izindlela zokubalekela ngabahlaseli, abahlukanisa amaphakethe, bafake ikhodi yemithwalo ngezindlela ezingavamile, noma abasebenzisa kabi izici zephrothokholi ukuze badlule izilawuli.

Ukunciphisa lezi zinselele kuhilela ukuhlanganisa ukwakheka okuhle kokuqala nokugcinwa okuqhubekayo : ukusungula izindlela zokusebenza, ukurekhoda amamethrikhi (abasebenzisi abakanyekanye, izicelo ngomzuzwana, izikhathi zokuphendula), ukuchaza izindima ezicacile (ubani ophatha imithetho, obani ababuyekeza izexwayiso, ukuthi izinqubomgomo zibuyekezwa kangaki), kanye nokuhlanganisa i-WAF ne-SOC, i-DevOps, kanye namathuluzi okuqapha enhlangano.

Izindlela ezinhle kakhulu zokuthola okuningi ekutholakaleni okuhlala kuvuliwe

Ukuqinisekisa ukuthi uhlelo lwakho lokusebenza lusebenza kahle hhayi ngokumelene nawe, kuyalulekwa ukulandela uchungechunge lwemikhuba abakhiqizi abaningi namaqembu okuphepha abayibona ibalulekile:

• Hlanganisa i-WAF nengqalasizinda ekhona (i-CDN, ama-load balancers, ama-proxies, i-SIEM, izixazululo ze-DDoS, i-IPS) esikhundleni sokuyibuka njenge-"cube ehlukanisiwe".
• Chaza ukusebenza kanye nama-KPI okuphepha kusukela ekuqaleni (izinga lokuhle elingamanga, ukuhlaselwa okuvinjiwe, ukubambezeleka okwengeziwe, njll.).
• Yethula izindima ezithile zokuphatha i-WAF, ehambisana nentuthuko, imisebenzi kanye ne-SOC, ukuze imithetho iguquke kanye nezinhlelo zokusebenza.
• Sebenzisa uhlu lwemithetho olulungiselelwe kusengaphambili njengesisekelo, kodwa zilungise kuhlelo lokusebenza ngalunye: chaza okuhlukile, uhlu olukhethekile lwabamhlophe kanye nemithetho yangokwezifiso yokugeleza okubalulekile.
• Hlanganisa namapulatifomu okuphatha imicimbi (i-SIEM) ukuze uhlanganise amalogi e-WAF nezinye izinzwa bese uthola umbono jikelele.
• Buyekeza izinqubomgomo njalo, ukususa imithetho ephelelwe yisikhathi kanye nokulungisa imikhawulo ekhawulela izinga, ukulawula iseshini kanye nokuvikelwa kuma-bot ngokuya ngokuziphatha kwangempela kwabasebenzisi.

I-WAAP ne-WAAS: ukuvela kwe-WAF kwezinhlelo zokusebenza zesimanje nama-API

Njengoba kukhuphuka izakhiwo ze-cloud-native, ama-microservices, nama-API yonke indawo, i-WAF yakudala ayiphumelelanga. Yingakho kuvela i-Web Application and API Protection (WAAP) , evame ukunikezwa njenge- Web Application & API Security (WAAS) njengesevisi , okuqhubeka phambili:

• Ukutholwa okuzenzakalelayo kwezinhlelo zokusebenza kanye nama-API endpointsukuvimbela izinsizakalo ukuthi zingashiywa zisobala ngaphandle kokuvikelwa.
• Ukungenisa imininingwane ye-API (Swagger, OpenAPI, njll.) ukuqinisekisa ukuthi izicelo ziyahambisana nenkontileka echaziwe.
• Ukuvikelwa okuqondile kwe-OWASP API Top 10 kanye nokusetshenziswa kabi kwe-logic yebhizinisi kumakholi we-API.
• I-bot ehlanganisiwe yezinga lesicelo kanye nokunciphisa i-DDoSngaphezu kwemisebenzi yendabuko ye-WAF.
• Amandla okusebenzisa izinqubomgomo ezahlukene nge-endpoint ngayinyeokwenza labo abaphatha idatha ebucayi babe nzima kakhulu.

Le ndlela ibonisa iqiniso lamanje: ubuthakathaka obuningi abusuki kuwebhusayithi evamile "yakudala", kodwa kunalokho buvela kuma-API angabhalwanga kahle, ama-endpoints anganakwa, kanye nezinsizakalo ezivezwe emafwini amaningi . Ukuzenzakalelayo kokutholwa kwazo nokuzivikela ngamakhono afanayo okuthola ahlala evuliwe kubalulekile ekuvimbeleni ukuthi iminyango yangemuva ingashiywa ivuliwe.

Sekukonke, ukuqonda okuhle ngalokho okwenziwa yi-WAF, ukuthi izindlela zayo zokuthola eziqhubekayo zisebenza kanjani, ukuthi yimaphi amamodeli okusebenzisa akhona, nokuthi ungayihlanganisa kanjani nayo yonke indawo yokuphepha kukuvumela ukuthi wakhe ukuzivikela okunamandla kakhulu mayelana nezinhlelo zokusebenza nama-API, unciphise ingozi yokuhlaselwa okuphumelelayo ngaphandle kokujezisa ubungqabavu noma ulwazi lomsebenzisi.

I-athikili ehlobene:

Ukuphepha kwewebhu ku-Django: umhlahlandlela osebenzayo futhi ojulile