OWASP TOP 10

OWASP Top 10 Web Application Vulnerabilities’ Mitigation using Prophaze WAF

The OWASP Top 10 vulnerabilities provide guidance to developers and security professionals on the most critical vulnerabilities that are commonly found in web applications, which are also easy to exploit. These 10 application risks are dangerous because they may allow attackers to plant malware, steal data, or completely take over your computers or web servers.

To make sure about availability and protect against abuse, it is possible to set API usage limits.

  1. Prophaze WAF provides real-time website protection by using powerful cloud-based technologies to maintain protection against the latest threats.
  2. Prophaze will automatically scan your website for thousands of known vulnerabilities and OWASP Top 10.
  3. Prophaze also ensures that the web applications are protect against being used as threat vectors into the client’s network.

Prophaze WAF requires no additional configuration but it automatically updates to include protection against new vulnerabilities.  It is possible to create/modify rules to match patterns of exploitation attempts in HTTP/S requests and block requests from entering your servers using Prophaze WAF.

Threats

Protection Methods

A1 – Injection·         Vulnerabilities filter

 

·         Database filter

·         Parameters filter

A2 – Broken Authentication·         Brute Force Filter

 

·         Session Filter Authentication  (login enforcement and session tracking)

·         Reply Cookie Flag

·         Clickjacking Protection

A3 – Sensitive Data Exposure·         Safe Reply filter

 

·         Session filter

·         Vulnerabilities filter (Predictable Resource Location)

·         Server error’s masking

A4 – XML External Entities (XXE)·         XML Security Filter

 

·         JSON Parsing property

·         Vulnerabilities filter

·         DB filters

·         Allow List filter

·         Tunnel’s Message size (max request body)

·         Unvalidated Redirect

A5 – Broken Access Control·         Session filter

 

·         Vulnerabilities patterns (XSS, detect predictable resources protection and components with known vulnerabilities)

·         Allow list (File type and Methods)

·         Role/IP/GEO based policy

·         Directory traversal protection

·         Authentication

·         Reply Cookie Flags

A6 – Security Misconfiguration·         Allow List filter

 

·         Parameters Filter

·         Path Blocking filter

·         Vulnerabilities filter (blocks predictable resources and known backdoors)

·         Automatic policy generation

·         RFC enforcement

·         Native R/T Proxy

·         Error Masking (eg. Masking error 500s)

·         Directory Listing Prevention

·         Masquerade Server Identity

·         Activity Tracking (prevents foreign scanners)

·         Role/IP/GEO based policy

·         DAST (integration with web scanners)

·         HSTS/Clickjacking

·         API Security

A7 – Cross-Site Scripting (XSS)·         Vulnerabilities filter

 

·         Database filter

·         Parameters filter

·         Reply Cookie Flags (HTTP-Only)

A8 – Insecure Deserialization·         Authentication (login enforcement and session tracking)

 

·         Session Filter (cookies protection)

·         XML security filter

·         JSON Parsing Properties

·         Vulnerabilities filter

·         Database filters

·         Parameters filter

A9 – Using Components with Known Vulnerabilities·         Allow List filter

 

·         Parameters Filter

·         Path Blocking filter

·         Database filter

·         Session filter

·         Vulnerabilities filter (blocks known patterns, backdoors and predictable resource)

·         Create custom patterns

·         Automatic policy generation

·         RFC enforcement

·         Error masking (eg. Masking error 500s)

·         Directory Listing Prevention

·         Masquerade Server Identity

·         Activity Tracking (prevents foreign scanners)

·         Role/IP/GEO based policy

·         Signature update mechanism

·         Source blocking feature

·         DAST (Integration with HP WebInspect)

·         Unvalidated Redirect

·         Reply Cookies Flags

·         HSTS/Clickjacking

·         API Security

A10 – Insufficient Logging and Monitoring·         Authentication (login monitoring)

 

·         DefenseMessaging

·         AppWall Forensics – Request/Response logging

·         APSolute Vision AVR

·         APSolute Vision Analytic

·         SIEM system integration

Get the demo
Cloud WAF | US (+831) 217-6365

Prophaze Team is happy to answer all your queries about the product.