WAF评估标准-v1.0.pdf

Web Application Firewall Evaluation

Criteria

Version 1.0 (January 16, 2006)

Copyright © 2005,2006 Web Application Security Consortium (http://www.webappsec.org)

Table of Contents

Introduction .............................................................................................................................2

Contributors .....................................................................................................................2

Contact ............................................................................................................................3

Categories ................................................................................................................................4

Section 7 - Management ..................................................................................................16

Section 8 - Performance ..................................................................................................20

Section 9 - XML .............................................................................................................21

A. Licence .............................................................................................................................21

1

Introduction

Web Application Firewalls (WAF) represent a new breed of information security technology that is de-

signed to protect web sites (web applications) from attack. WAF solutions are capable of preventing at-

tacks that network firewalls and intrusion detection systems can't. They also do not require modification

of the application source code. As today's web application attacks expand and their relative level of soph-

treated like this.

To conclude: the purpose of this document to draw one's attention to the features that are of potential im-

portance to a given project. This comprehensive list should be used as basis to form a much shorter list of

features that are required for the project. The shorter list should then be used to evaluate multiple web ap-

plication firewall products.

Current categories are as follows:

1. Deployment Architecture

2. HTTP Support

3. Detection Techniques

4. Protection Techniques

• Compliance, certifications, and interoperability.

• Increase coverage of performance issues (especially on the network level).

• Increase coverage of the XML-related functionality.

Contributors

This document is a result of team effort. The following people have contributed their time and expertise

to the project:

• Robert Auger (SPI Dynamics)

• Ryan C. Barnett (EDS)

Web Application Firewall Evaluation Criteria

2

• Charlie Cano (F5)

• Mark Kraynak (Imperva)

• Vidyaranya Maddi (Cisco Systems)

• Ofer Maor (Hacktics)

• Cyrill Osterwalder (Seclutions AG)

• Sylvain Maret (e-Xpert Solutions)

• Gunnar Peterson (Arctec Group)

• Pradeep Pillai (Cisco Systems)

• Kurt R. Roemer (NetContinuum)

• Kenneth Salchow (F5)

• Rafael San Miguel (daVinci Consulting)

• Bob Walder (NSS Group)

Contact

Participation in the Web Application Firewall Evaluation Criteria project is open to all. If you wish to

comment on the evaluation criteria or join the team mailing list please contact Ivan Ristic via email

(<ivanr@webkreator.com>).

Web Application Firewall Evaluation Criteria

3

Categories

Section 1 - Deployment Architecture

This section highlights the questions key to determining the feasibility of web application firewall deploy-

ment in a given environment.

1.1 Modes of Operation

Can the device be operated in both passive and active (inline) mode?

plain the level of integration with the web server. Some embedded web application firewalls

may only tap into the communication channel and do everything themselves. Others may rely

on the web server to do as much of the work as possible. (Both approaches have their advant-

ages and disadvantages.)

1.2 SSL

SSL is often used to protect traffic coming from and going to web applications. While this type of protec-

tion achieves the goal of data protection, it hides the data from the protection systems (e.g. intrusion de-

tection systems, web application firewalls) at the same time. Since SSL is in widespread use - in fact, se-

cure deployments require it - if a WAF cannot get to the traffic then it will be unable to perform its func-

tion.

is separately decrypted and processed.

3. Not Applicable. Working embedded in a web server, a WAF can be positioned to work just

after the SSL data is decrypted into plain-text.

Client certificates criteria:

1. Are client certificates supported in passive mode?

2. Are client certificates supported in active mode?

Web Application Firewall Evaluation Criteria

4

3. In termination mode, can the content from client certificates be sent to the application using

some alternative transport method (e.g. request headers).

1. In termination mode, can the backend traffic (i.e. the traffic from the WAF to the web server)

4. Can the WAF retrieve SSL keys from an external key storage facility (e.g. network-based

Hardware Security Module)?

5. Is the SSL implementation FIPS 140-2 certified? Which FIPS levels are supported (level II

ated on the WAF. Attacks are blocked by not forwarding the blocked requests to the destina-

tion.

2. Connection Interruption. Traffic is inspected, but not terminated by the WAF. Attacks are

blocked by stopping the connection to the destination. This can be either before any packets ar-

rive at the destination (e.g. a single-packet attack), or after a partial connection has been buf-

fered, but not completed, on the destination (e.g. in the case of segmented packets).

3. Connection Reset. Traffic is inspected by the WAF either via active, passive or embedded in-

spection mechanism. Attacks are blocked by resetting the relevant network (TCP) connections.

Connection reset is often used in conjunction with other blocking mechanisms.

4. Blocking via third-party device. Traffic is inspected by the WAF. Attacks are blocked by noti-

5. Blocks the application user.

When blocking is taking place on the HTTP level, can the WAF be configured to present the user with a

friendly, meaningful, message? Can a unique transaction ID be presented to the user (see Section 5.1)?

For a WAF that supports blocking, is it possible to turn blocking off (completely, or for certain types of

requests only - determined dynamically for every request)?

Web Application Firewall Evaluation Criteria

5