3 ms·

This is a really good example of why, if you have something important to your organisation on the Internet, you need to really be doing defence in depth, to eit

This is a really good example of why, if you have something important to your organisation on the Internet, you need to really be doing defence in depth, to either reduce the risk of compromise, and/or increase your chance of noticing when you're attacked and reacting accordingly. So things like IDS (network and host), perhaps looking at adding a WAF to catch basic attacks, shipping all your logs off your front end servers so they can't be easily destroyed by attackers etc. This kind of disclosure--> attack timeline now looks to be the norm, so this will become a theme and companies are either going to have to spend more on defense, or spend more on incident clean-up and then spend more on defense....

dc2447 12y ago
WAF are a bad idea imvho. They can give a false sense of security and the feeling that security is being taken care of. The reality is theta they are generally not very good at catching anything other than the most basic of attacks. I much prefer - external security monitoring (there are many vendors) - automated testing in pre production using skipfish/w3af/whatever - static code analysis - penetration testing - responsible disclosure programmes - hackdays
- raesene4 12y ago
  I don't see it as an either/or decision TBH. I wouldn't suggest that WAFs are a panacea, but that doesn't mean that they can't be a useful defensive layer. A lot of companies have difficulties getting app. patches applied quickly due to test cycles, so applying a WAF rule to block known issues (this one for example) can be a fast, low risk way of reducing the risk.
- muppetman 12y ago
  You'd be surprised at how many robot attacks don't have a user agent, or similar things you can trigger on. I agree, a direct targetted attack against your site they won't help (much). But for stopping a lot of robotic, automated hacking attempts they certainly have their place.
- daviddede 12y ago
  Virtual patching is the main benefit on WAFs for cases like this. We were able to issue a virtual patching signature for our clients in less than 2 hrs after the disclosure. Plus, our generic SQL injection signatures were already blocking this attack even without it. That gives our clients more time to test and deploy patches without worrying about being compromised in the middle.

dc2447 12y ago

WAF are a bad idea imvho. They can give a false sense of security and the feeling that security is being taken care of. The reality is theta they are generally not very good at catching anything other than the most basic of attacks. I much prefer - external security monitoring (there are many vendors) - automated testing in pre production using skipfish/w3af/whatever - static code analysis - penetration testing - responsible disclosure programmes - hackdays

raesene4 12y ago
I don't see it as an either/or decision TBH. I wouldn't suggest that WAFs are a panacea, but that doesn't mean that they can't be a useful defensive layer. A lot of companies have difficulties getting app. patches applied quickly due to test cycles, so applying a WAF rule to block known issues (this one for example) can be a fast, low risk way of reducing the risk.
muppetman 12y ago
You'd be surprised at how many robot attacks don't have a user agent, or similar things you can trigger on. I agree, a direct targetted attack against your site they won't help (much). But for stopping a lot of robotic, automated hacking attempts they certainly have their place.
daviddede 12y ago
Virtual patching is the main benefit on WAFs for cases like this. We were able to issue a virtual patching signature for our clients in less than 2 hrs after the disclosure. Plus, our generic SQL injection signatures were already blocking this attack even without it. That gives our clients more time to test and deploy patches without worrying about being compromised in the middle.