Application Security for Every Scale
my.defence
Cloud computing was not designed for security, although organizations such as Cloud Security Alliance (CSA) and Open Web Application Security Project (OWASP) are making great strides in helping the industry solve the myriad security problems confronting cloud computing. The benchmark guidelines established by the CSA in the document, Guidance for Critical Areas of Focus in Cloud Computing, is a great first step. This white paper is intended to pick up where the CSA guide left off in terms of defining what a distributed web application firewall (dWAF) should look like in order to meet the standards set within the CSA document.
As a hosting provider you normally have all of your systems fault tolerant, have backup data lines in different backbones, your standby set allows electrical power outage for more than one hour and your security systems inspect each data package and know everything about IP address from source and destination. Port and type of protocol and in the payload of the packages you can find some additional informations.
This helps, to make your servers resistant against the known attacks at the transportation layer and allows you to guarantee your customers an operational availability up to 99%.
This sounds perfect for systems like mail, ERP, CRM and some other essential systems to run the business in a company. But one of the systems of your customer is different. This is the web server, where the whole world has access and where the customer portals run with access to all the other critical applications.
The tricky thing on this type of system is, that all the frameworks for web application development have bugs and thus need updates from time to time for example PHP, Typo3.
The next problem is, that the web applications are normally developed from an external company without update contract. So the front facing interface in the internet would be insecure over a short period of time and the connected application systems become vulnerable.
And you and your staff are not aware, because all of your monitoring and analyzing happens at the transportation layer. So you are in trouble, if a customer asks you about security events in his systems without suitable logs.
To know more about the events in the web traffic, you need a web application firewall like hyperguard from art of defence. Hyperguard analyses the incoming and outgoing web traffic and has the possibility to deny suspect or unsecure requests. With the included mechanism to deny specified type of requests, you can „virtually patch“ the web applications of your customers with some global rules against new vulnerabilities in different versions of frameworks. In addition you avoid the stress for your customers to patch the application within a short time.
One of the most valuable charakteristics of hyperguard is the partition of monitoring and protection and the possibility to run two rulesets in parallel (one active, one in monitoring mode) This allows very granular rulesets and fault resistant testing. This avoids interruptions in the business process, because false positives are already encountered in detection mode. hyperguard offers with one „click“ a baseline protection against the most common vulnerabilities of web applications, provides black-, white- and greylisting and supports proactive security functions like URL encryption against vulnerabilities like cross site scripting, SQL-injection and some others (OWASP Top10).
Additional functions for Cookie protection and against Denial of Service protect the user and the web server. For you as a hosting provider, hyperguard solves in a perfect manner the requirements of your business, because the implemented hierarchical multi administrator model offers your customer all possibilities to make applications secure. You can offer these possibilities to all of your customers with hosted web applications with the chance to know more about the traffic in their web servers.
The flexbile licensing of hyperguard has the potential to offer monitoring and reporting for all of your customers for a small amount of money and it also offers the possibility to switch from monitoring to protection without great additional invest. Talk to us, because hyperguard is available in diffeent license models, as SaaS and as dWAF for Cloud services.
