3 ms·
Our general advice to businesses and individuals utilizing Apache Struts as well as any other open or closed source supporting library in their software product
by smaili 9y ago
Our general advice to businesses and individuals utilizing Apache Struts as well as any other open or closed source supporting library in their software products and services is as follows:
1. Understand which supporting frameworks and libraries are used in your software products and in which versions. Keep track of security announcements affecting this products and versions.
2. Establish a process to quickly roll out a security fix release of your software product once supporting frameworks or libraries needs to be updated for security reasons. Best is to think in terms of hours or a few days, not weeks or months. Most breaches we become aware of are caused by failure to update software components that are known to be vulnerable for months or even years.
3. Any complex software contains flaws. Don't build your security policy on the assumption that supporting software products are flawless, especially in terms of security vulnerabilities.
4. Establish security layers. It is good software engineering practice to have individually secured layers behind a public-facing presentation layer such as the Apache Struts framework. A breach into the presentation layer should never empower access to significant or even all back-end information resources.
5. Establish monitoring for unusual access patterns to your public Web resources. Nowadays there are a lot of open source and commercial products available to detect such patterns and give alerts. We recommend such monitoring as good operations practice for business critical Web-based services.
- blktiger 9y ago#1 here can be automated. My current employer sells one such solution, though there are of course others. Here is a blog post about the vulnerability from back when it was discovered earlier this year. http://blog.sonatype.com/2017-struts2-vulnerability-exploit-speed-matters http://blog.sonatype.com/2017-struts2-vulnerability-exploit-...
- upstarter 9y ago> 1. Understand which supporting frameworks and libraries are used in your software products and in which versions. Keep track of security announcements affecting this products and versions. This issue is solved by having your server OS download and install security updates automatically, which amounts to more or less uncommenting 1 line of config. Edit: Downvoter(s), please comment.
- solomatov 9y agoI am not the downvoter (and I didn't donwvote you) but I explain why it won't help. Struts is packaged as a jar file which is distributed inside of the war file which is basically application. The struct's jar is an essential part of the application and it can't be updated separately by the OS.
- wglb 9y agoWith respect to This issue is solved I suggest rewording it as This issue is partially solved, since in almost any real-world large web application, there is a significant number of third-party libraries that won't be automatically updated.
- upstarter 9y ago> 4. Establish security layers. It is good software engineering practice to have individually secured layers behind a public-facing presentation layer What are your best sources/tutorials explaining the perfect server architecture setup which address this point?
- Rapzid 9y agoYou're looking for information on N-tier applications; https://msdn.microsoft.com/en-us/library/bb384398.aspx?f=255&MSPPError=-2147217396 https://msdn.microsoft.com/en-us/library/bb384398.aspx?f=255.... You don't come across this too often these days in OSS or startups. It's a pretty big explosion in complexity. What hot N-tier enabling frameworks have you read about recently?