Table of Contents
The Profense™ platform is a modular web application assurance system offering acceleration, scalability and proactive protection of web systems. The following modules are available:
- Load Balancer
-
Enabling scalability and acceleration of even complex SSL-enabled stateful web applications.
- Web Accelerator
-
Reducing traffic cost, improving response time and off-loading web servers.
- Web Application Firewall
-
Proactive protection of web servers and web applications by employing a positive security model.
The Profense™ Load Balancer module enables scalability and acceleration of even complex SSL-enabled web applications.
Session persistence is achieved through insertion of a cookie tracking the session.
When the Profense™ Load Balancer is configured in an active/active cluster (is load balanced itself) the session persistence is independent of the cluster node handling the request.
Profense™ Load Balancer offers guaranteed SSL session persistence by decrypting the SSL content.
In this way the client is guaranteed a secure persistent browsing experience without loss of state information.
As SSL-connections are terminated by Profense™ it works equally well with HTTP and HTTPS.
Optionally requests from clients can be re-encrypted before being forwarding to back-end servers.
Requests are distributed to backend servers following one of the two methods below:
- Round robin
-
Requests are distributed equally in a round robin fashion to all active servers.
- Session persistence
-
When a server is selected according to the methods above all subsequent requests for the same client can be sent to the same physical server in order keep state information for that client on that server. This method is also referred to as client stickyness.
The web accelerator module accelerates web application and web system performance by:
-
Lowering the web and application server workload
-
Optimizing and reducing bandwidth usage
-
Offloading SSL operations from web servers
-
Optimizing TCP-connection handling
Caching of static documents improves performance by 300 - 500%.
Documents that can be cached, are locally stored by Profense™. Any further requests for documents found in the cache, are automatically delivered to clients directly from Profense™. Therefore, the back-end web servers can focus on delivering dynamic content with improved response times to clients, without the overhead of delivering static content like images, PDF documents, static HTML documents, style-sheets and others.
Dynamic compression of transmission data reduces bandwidth usage by 30 - 60% and increases transfer rate by 50 - 100%.
HTTP compression reduces the transfer volume of static and dynamically generated web pages to approximately 1/3 of their original size proportionally speeds up the load time performance. This results in reduced traffic costs and in a better experience for the web site visitors.
Profense™ has the ability to terminate HTTPS (SSL) based connections and requests from clients before forwarding them as HTTP non-SSL) to back-end servers.
This off-loads the back-end web servers from expensive SSL calculations thus allowing them to focus on faster content delivery to clients.
When forwarding legitimate requests from clients to back-end web servers, Profense™ will reuse socket connections already established with the back-end web server.
This gives a performance increase since back-end servers don't waste resources on establishing new and tearing down old socket connections.
Profense™ Web Application Firewall is implemented in the network as a filtering gateway which validates all requests to the web systems.
On a general level the web application firewall module has the following protective features:
-
Web server cloaking and customizable HTTP error handling completely shield web servers from direct Internet access and defeat fingerprinting attacks.
-
White-list based filtering of input data (including all URLs and parameters) allows for protection against threats from unpublished vulnerabilities in web server software and web applications.
-
Validation of requests using a combination of positive and negative policy rules. Available in Profense Professional.
-
HTTPS termination allows for white-list based protection from SSL-encrypted attacks.
-
The protection is always updated as there is no dependence on signatures due to the positive security model.
All versions of Profense™ includes the automated application profiling, or learning, engine which allows for completely automated policy building.
Profense Professional offers Auto mode using a
combination of positive and negative policy rules with adaptive learning
of changes in the web applications. The Auto mode provides instant
protection which improves as Profense learns the web applications and
consequently can create positive policy rules for critical application
components.
Profense™ is based on the positive security model. It determines allowable requests, and inputs and disallows everything else. This approach provides protection against unknown threats, simply because they are not in the white-list and thus are disallowed.
The working basis of the positive security model is that everything is forbidden unless explicitly allowed. In the context of Profense™ this implies that only allowed requests are forwarded to the web system - that is: requests for web pages, applications, parameters etc. which you allow. This positive security approach is proactive because you base your protection on known information, the business content you want your web system to make available, not attack signatures and other potentially unknown information.
In Profense™ Professional the negative security model - signatures matching known attacks - can be used in combination with positive policy rules. For example it is possible to specify (or learn) strict positive input validation rules for certain critical application components, like login.php or payment.jsp, and use more general negative signatures for the remaining part of the web site.
Because of Profense™'s positive security model it stops exploits of vulnerabilities and weaknesses without dependence on signatures. By building an access control list based on a finite amount of information, the business content of the web system, Profense™ effectively blocks attacks from hackers and worms.
In other words: Profense™ does not identify attacks, it determines if a request is allowed based on a white-list. If a request is not in the list it is treated as if it was an attack. This means that Profense™ also protects from attacks targeting unpublished vulnerabilities.
Profense™ validates all parts of a HTTP request (including the path, query and segment) according to the defined access policy.
Requests not-matching the access-policy, are per default flagged as illegitimate, rejected and logged for further analysis. This allows system administrators to have a strict white-list of legitimate URLs for a given web application.
In Profense™ Professional policy rules can be specified using positive matching for specific URL and negative for all other.
Profense™ validates all parts of a query in a URL request according the defined white-list access policy.
Each parameter and the corresponding value is validated. This allows system administrators to specify what input is allowed for a given URL resource.
In Profense™ Professional, as for URLs, combinations of negative and positive policy rules can be employed.
Rules which match parameters on a global basis can be specified using regular expressions or signature based matching (in Profense™ Professional).
This is particularly useful when for instance the web application uses global parameters for session tracking or for printer friendly displaying instructions.
Profense™ can enforce pragmatic and strict standard HTTP headers compliance (RFC2068/RFC2616).
All request from clients are validated against a strict positive list of valid HTTP headers and values. This prevents possible attacks that exploit vulnerable web applications and servers through illegal HTTP headers.
Strict HTTP headers compliance checking can potentially cause problems with clients that deviate from standards or are otherwise incompatible.
Pragmatic HTTP headers compliance checking is a more loose access policy enforcement comparing to the strict method described previously which still protects web applications and servers from validating values for the submitted parameters according to a positive list of allowed data compiled from the strict RFC compliant heads.
Pragmatic HTTP headers checking allow non-standard headers to pass through Profense™.
Profense™ completely isolates the web server from direct Internet requests and information and web system technology information is removed from web server responses.
A typical web server gives out a lot of information about it's version, installed software, operating system, etc. This information is completely irrelevant for normal HTTP/HTTPS communication between clients and web server. However, attackers and worms can misuse this information to craft more targeted attacks on a vulnerable web application or server. Profense™ removes this information from the response sent back from the back-end server before forwarding it to the client thus protecting the web application and server from leaking potentially sensitive information.
Profense™ terminates all HTTP/HTTPS requests from clients before forwarding legitimate requests to back-end web servers. This means that back-end web servers are isolated from clients (typically from the Internet) and are placed on a back-end network/LAN segment. Network isolation means that only HTTP/HTTPS traffic is actually forwarded to the back-end servers. Any other network traffic (for instance a ICMP flood attack or a request to another potentially vulnerable service) will never reach the back-end servers thus eliminating other network threats as well.
Profense™ automatically generates access policies for even complex web applications and web systems.
All relevant information for a web application including URLs, parameters and HTTP methods is automatically learned by Profense™ and applied to the running access policy. This allows system administrators to quickly enable new or updated information about the web application thus reducing the manual work needed when implementing new or changed access policies.
Profense™ has full support for standard PCRE (Perl Compatible Regular Expressions).
This feature allows system administrators to manually fine-tune and implement strict values for legitimate HTTP parameters.
In order to simplify the ACL Profense™ supports the definition of URL wild cards based on regular expressions which matches URLs without parameters on a proxy global basis.
Rules which match parameters on a global basis can be specified using regular expressions.
This is particularly useful when for instance the web application uses global parameters for session tracking or for printer friendly displaying instructions.
All rejected requests are classified in major attack groups (i.e. SQL-injection, buffer overflow, etc.) using a combination of cross validation, heuristic patterns and statistics.
Alerts can be sent to external syslog server or email.
Alert levels are completely configurable and are mapped to standard syslog priorities (information levels).
The management interface includes a comprehensive security log displaying all the necessary details about blocked requests, including the time stamp, IP address, HTTP methods, path and query segments, HTTP headers violations, attack classification and raw request data.
Multiple search criteria can be specified using wildcards allowing for detailed drill down searches. Customizable reporting.
All log views (searc filter sets) can be exported to printable reports or XML.
Though ease of use is a qualitative statement we prefer regarding it as a product feature in order to keep development focus on the usability aspect. Misconfiguration of systems is a major source of vulnerability. Therefore ease of use is a security feature as it increases the likelihood of getting things right the first time and thus reduces the risk of human error due to complexity and misconceptions.
Ease of use is achieved through:
- Simplifying the complex
-
A fundamental concept of Profense™ is simplicity. There are no bells and whistles and every feature reflects real life needs of security demanding organizations.
- Clear and intuitive graphical user interface
-
The web based graphical user interface provides access to manage all system and module functions.
- Automated remote backup
-
The complete running Profense™ installation including all settings, proxies and access policies can be automatically backed up by Profense™ to a remote FTP server.
This feature is available in Profense™ Professional.
- Manual full and partial backup
-
A complete Profense™ installation or the entire configuration of a single proxy can also be backed up manually with a few clicks in the management interface.
- Easy restore
-
A complete Profense™ configuration including access policy for all defined proxies can be restored from an FTP-server or the file system with a few clicks in the management interface.
- Clustering
-
Active/active clustering with automatic policy synchronization allows for virtually unlimited scalability.
This feature is available in Profense™ Professional.
- High availability
-
Profense™ can be run in active/passive configurations where two or more physical Profense™ nodes together comprise a logical Profense™ unit with hot fail-over and automatic synchronization of rules across the units.
Automatic synchronization is available in Profense™ Professional.
Profense™ is based on proven methods and technology.
With Profense™ the organization gets transparent state of the art protection of web systems and web applications - without compromising functionality and software and hardware policies.
Profense™ combines the flexibility and scalability advantages of software with the security advantages and administrative simplicity from dedicated hardware appliances. The Profense™ software appliance installer turns a piece of general purpose application server hardware into a dedicated application acceleration and security gateway within minutes - with minimal interaction.
The Profense™ software package is completely self contained and no system level expert know-how or low level interaction is required to install and run Profense™.
The web based administrative interface provides access to perform all necessary administrative tasks, including initial configuration, administration of clustering and filtering rules, backup, log and reporting functions.
Profense™ is based on a stripped and hardened OpenBSD platform which is regarded as the most secure OS generally available.
The proxy, filtering and administration components run in a non-privileged and closed run-time environment and technologies like ProPolice, W^X protection, non-executable stack, etc. are used to further harden the system against attacks.
With Profense™ you get a seriously hardened and secured frontend to your web applications - without compromising functionality.