Web Service Custom Policies

Web Service Custom policies provide you with a flexible engine that correlates between the server group and service protection levels and which is based on CAV technology, see Correlated Attack Validation (CAV) Used in Correlation Policies. This is done by creating user-defined policies based on different combinations of the match criteria. Correlation policies can be manually configured or are available as predefined rules that cover certain well-known scenarios.

For example, using custom correlation policies you can limit access to specific URLs and directories based on the source IP address. You can also restrict the permitted HTTP headers, user agents (browsers), and so on. You can define as many custom correlation policies as you want. It is recommended to perform as many operations as possible using predefined profile/protocol violation policies and use custom correlation policies only for operations that are otherwise impossible to perform.

Web Custom Policies Match Criteria presents match criteria used in the web custom policies.

EXAMPLE: Automated Vulnerability Scanning

The Automated Vulnerability Scanning policy is one of the predefined web custom policies that is used to detects and prevent scanning attempts. Understanding of how this policy is defined using web custom match criteria can help you to understand how to define web custom policies.

If SecureSphere identifies a number of violations in the predefined period of time that is higher than the predefined number, it indicates that there is a scanning attempt.

To detect and prevent scanning attempts:

1. In the Main workspace, select Policies > Security.
2. In the Policies pane, click and select Web Service. The Create New Policy dialog box appears.
3. Type the name of the new policy, from the Type drop-down box, select Web Service Custom and click Create.
4. In the Match Criteria tab, click on the green arrow next to Violations.
5. Expand the Violations match criteria and select the violations on which you want to get alerts.
6. To define match over time, click on the green arrow next to Occurrence.
7. Expand the Occurrence match criteria and define the following parameters:
8. Define the reaction settings, see Modifying Policies in the Security Window.
9. Click Save. Settings are saved. If you are in delayed activation mode, you need to activate these settings. For more information, see Activating Settings.

EXAMPLE: Blocking Traffic from a Specific Geographic Location

Malicious attacks can come from any location. Though every day concerted attacks whether for profit are often launched from a specific geographic locations. You can use the SecureSphere Source GeoLocation criteria to configure a custom Security Policy to block undesired traffic originating from a specific geographic location based on country name.

To configure a policy based on geographic location:

1. In the Main workspace, select Policies > Security.
2. In the Policies pane, click and select Web Service. The Create New Policy dialog box appears.
3. In the Name field, type the name of the new policy.
4. Select From Scratch and from the Type drop down select Web Service Custom.
5. Click Create. The policy is created and appears under the Web Service Custom section in the Policies pane.
6. To block all traffic from a specific geographic location (e.g. Syria):
   1. From the Action drop down, select Block.
   2. From the Available Match Criteria list, click on the green arrow next to Source GeoLocation.
   3. Expand the Source GeoLocation match criteria and from the Operation drop down select At least one.
   4. In the Country pane, select the country you want to block traffic from (e.g. Syria) and move it to the Selected pane.
   5. Repeat step d for all countries you want to block traffic from.
   6. Click Save. Any traffic that emanates from the selected countries is blocked.
7. To allow all traffic from a specific geographic location (e.g. USA) and from your private network:
   1. From the Action drop down, select Block.
   2. From the Available Match Criteria list, click on the green arrow next to Source GeoLocation and Source IP Addresses.
   3. Expand the Source GeoLocation match criteria and from the Operation drop down select Exclude all.
   4. In the Country pane, select the country you want to allow traffic from (e.g. USA) and move it to the Selected pane.
   5. Repeat step d for all countries you want to allow traffic from.
   6. Expand the Source IP Addresses match criteria and from the Operation drop down select Exclude all.
   7. In the IP Groups pane, select Internal IP Addresses and move it to the Selected pane.
8. Click Save. Any traffic that emanates from the selected countries and from your private network is allowed.

EXAMPLE: Tuning the HTTP Protocol Validation policy

Sometimes the custom policies mechanism can be used not only to define new custom policies, but also to tune the existing policies. For example, you do not want to block your incoming traffic or to get alerts when the Abnormally Long Request violation is detected, which is a part of the HTTP Protocol Validation policy. It is important for you to get alerts, but only during the working hours. In addition, you do not want to get alerts on the traffic that arrives from the development team.

To define the custom policy:

1. In the Main workspace, select Policies > Security. In the Policies pane, click and select Web Service. The Create New Policy dialog box appears.
2. Type the name of the new policy, from the Type drop-down box, select WEB Service Custom and click Create.
3. In the Match Criteria tab, click on the green arrow next to Violations.
4. Expand the Violations match criteria and select Abnormally Long Request.
5. To define match over time, click on the green arrow next to Occurrence.
6. Expand the Occurrence match criteria and define the parameters in the table Occurrence Parameters below.
7. Select Time of Day, expand it and highlight the days and hours in which you want to get alerts.
8. Define the reaction settings, see Modifying Policies in the Security Window.
9. To avoid applying this policy on the development team, select Source IP Addresses and set the parameters in Source IP Address Parameters below.
10. Click Save. Settings are saved. If you are in delayed activation mode, you need to activate these settings. For more information, see Activating Settings.

Occurrence Parameters

Source IP Address Parameters

The following table presents the predefined policies that can help you to protect your web services against specific attacks and threats.

Predefined Web Service Custom Policies