d3tlv17- keeping it safe

Keeping it SafeBen Herzberg

Security Research Group Manager, Imperva

@KernelXSS @imperva

2

> ben.childNodes.length<· 2> ben.history<· [“PT”,”Dev”] > ben.employer<· “Imperva”> ben.positionX<· “Research Group Manager”> ben.social<· {“TWT”: “@KernelXSS”, “LNK”: “Ben Herzberg”}

© 2017 Imperva, Inc. All rights reserved.

Web Application Security


Our “Ground Rules”

As little config as possible

Focus on low FPs

Use our CDN to cover more AVs


Being app agnostic…



Example #1: SQL Injection

Queries sent over an application

Pseudo-SQL

“Close Calls”



Example #2: Cross-Site Scripting

HTML sent as part of request

Javascript sent as part of request

Javascript being… Javascript…



Example #4: MISC…

GET + Content-Type + Content-Length

/%00/demo/welcome

src=../../../../windows/bannerWindow/a.jpg

PHP in RFI


Platforms & Frameworks


So what do we do?


Automate all of the things


Find new stuff

TRAP

ASSESS

BLOCK

REPEAT© 2017 Imperva, Inc. All rights reserved.

Find new stuff

Algorithmics

(ML)


Vulnerabilities Tracking


Why?

Create a clear process for Vulnerabilities Management

Give our customers an efficient & prioritised vulnerability response procedure

Unified process


New VR+EF: Scoping

CVSS>9.0 NO AUTH+ = HPC

WEB REMOTE

+ +

10+

TWEETS = HPC

CVSS>7.04+

TWEETS

=

REGULAR+ HAS

EXPLOITORCVSS>8.0

=REGULAR

…

SEC

INTEL. = HPC


Business Days

HPC REGULAR+

OOS

OOTB

Followup

Mitigation Needed

Emergency Feed


Weekends

HPC

OOS

OOTB

Followup

Mitigation Needed

Emergency Feed


Some of our projects…


TMI


Antivirus

1987 1992

Firewall

1999

WAF

IPS

NOW


Attack Analytics


Putting things in context…


IP Reputation


Automated Attacks


30

@KernelXSS, @imperva

Thank You!

Let’s Talk!linkedin.com/in/sysadmin

[email protected]


http://linkedin.com/in/sysadmin

d3tlv17- keeping it safe

Technology