Improving Web Application Security: Threats and - CGISecurity

Chapter 15: Securing Your Network 415●●Stateful inspectionApplication filters are limited to knowledge of the payload of a packet andtherefore make filtering decisions based only on the payload. Stateful inspectionuses both the payload and its context to determine filtering rules. Using thepayload and the packet contents allow stateful inspection rules to ensure sessionand communication integrity. The inspection of packets, their payload, andsequence limits the scalability of stateful inspection.Custom application filtersThese filters ensure the integrity of application server/client communication.When you use filters at multiple levels of the network stack, it helps make yourenvironment more secure. For example, a packet filter can be used to block IP trafficdestined for any port other than port 80, and an application filter might furtherrestrict traffic based on the nature of the HTTP verb. For example, it might blockHTTP DELETE verbs.Logging and AuditingLogging all incoming and outgoing requests — regardless of firewall rules — allowsyou to detect intrusion attempts or, even worse, successful attacks that werepreviously undetected. Historically, network administrators sometimes had toanalyze audit logs to determine how an attack succeeded. In those cases,administrators were able to apply solutions to the vulnerabilities, learn how theywere compromised, and discover other vulnerabilities that existed.Apply the following policies for logging and log auditing.● Log all traffic that passes through the firewall.● Maintain healthy log cycling that allows quick data analysis. The more data youhave, the larger the log file size.● Make sure the firewall clock is synchronized with the other network hardware.Perimeter NetworksA firewall should exist anywhere your servers interact with an untrusted network. Ifyour Web servers connect to a back-end network, such as a bank of database serversor corporate network, a screen should exist to isolate the two networks. While theWeb zone has the greatest degree of exposure, a compromise in the Web zone shouldnot result in the compromise of downstream networks.By default, the perimeter network should block all outbound connections exceptthose that are expected.