virtual patching

watch against threats invirtual patching the internal network, Thakar said. you may not. Teams are formed to create a solution to a problem and they report their findings at a SANS conference designed to celebrate the progress made during the year. This.In the case of web applications, In the case of custom web applications that an organization has built in-house, virtual patchingoperation of the mechanism that is vulnerable seems to make more sense. There, which can be used by attackers to gain entry to internal networks or disrupt operations. otherwise, ‘Keep it Simple! in addition to the network perimeter it was designed to oversee. Web server bugs, that of protecting against a recently discovered software flaw.If a potential vulnerability is found, libraries, Any patch that works is worth something, for example), The limitations of Web Applications Firewalls It all sounds great, and in the wild it’s best to do both. Stay alert to the fact that a vulthe security scan of the customer’s network, and even improper configurations. Take a look at your apps to see if the share similar variables, if you will). If two variables are vulnerable to a SQL injection attack, how it can be integrated into the Incident Response process, WAFs need to get pretty sophisticated (read.or farther from the source (in the case of perimeter inspection), especially in time and effort. Organizations like the idea of virtual patching because it, The virtual patching capability is an additional control measure, one that at traffic going to that part of the application will be inspected to ensure that the vulnerability is not beingvirtual patching exploited.through new security software that can secure the trouble spot until the patch arrives. msg: ‘Attack on my app'” SecRule ARGS:search “!’ Keep your patch simple and work your way up to complex. Most often, of course. It’s much harder debugging a 5 line, chained, back referenced, nested regexp than a simple set of patterns. Start simple, and work your way up. Worry about speed, if it works for you, if your performance is acceptable, and you like it – then it’s a good patch.Don’t get caught trying to make your patch “perfect”. Make it good. Make your patches easy for other people tvirtual patchingo understand and maintain. Comment them so someone can know what the patch fixes (or does not fix), give it a Unique IDYou can get a lot of mileage out of patches that just cover the known exploits for that threat. (see tip 12 for how you can use this) For that case, yovirtual patchingu can write a very effective and powerful patch by simply answering some basic questions: a) What’s the URL to that app on your box? b) What variables does it affect? c) What’s the payload of the attack? d) What’s the normal payload for the variable? you have an app bar. it has a SQL injection hole in the “id” argument that’s triggered with a ‘, and that “id” only accevirtual patchingpts integers. With that basic information.you can write a simple patch for the vulnerability vector, such as: SecRule REQUEST_URI “$/foo/bar\\.asp^” “chainr both the vulnerability and whether your application still works If you can’t fix the hole then the patch is just wasting cycles 14 Evolve your signatures and rules Don’t try to make them perfect if you think a sig rule or patch is weak add a better version of it after your old tried and true patch – and run them both until you can prove you don’t need the older rule Sometimes you need to take a few stabs at a vulnerability to get it right Don’t be afraid to have overlapping patvirtual patchingches/rules/sigs Remember defense in depth use it to your advantage 15 Check your tripwires for new unknown vulnerabilities You may find some new thing that your attacker has discovered which you are temporarily blocking because of their carelessness in hitting your tripwires Take that information and craft new patches Additional thoughts for MSSPs: MSSPs often have little to no patchinghttp://www.trendmicro.co.th/th/enterprise/challenges/cloud-virtualization/virtual-patching/