Ensure Web Application Firewall (WAF) is configured with appropriate protection policies in all the WAF rules in use

MediumLevel 2Manual reviewsophos

Description

Sophos firewall protects web servers against Layer 7 (application) vulnerability exploits. These attacks include cookie, URL, and form manipulation. It can also mitigate common threats such as application and cross-site scripting (XSS) attacks. Sophos firewall provides default policies for some common web services. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Navigate to 'Protect > Web server > General settings > SlowHTTP protection settings'. Verify that 'Time-out for request headers' is 'ON'. Verify the minimum amount of time to receive a request 'Soft limit' is set to optimal configuration. Default setting is '10'. Verify the maximum amount of time to receive the request header 'Hard limit' is set to optimal configuration. Default setting is '30'. Verify the amount of data, in bytes, to extend the time-out set by the soft limit. Every time the rate is exceeded, the soft limit is increased by one second. (Full steps: CIS 5.5.)

How it is fixed

Fix method: Guidance or infrastructure patch

Navigate to 'Protect > Web server > General settings > SlowHTTP protection settings'. Set 'Time-out for request headers' to 'ON'. Set the minimum amount of time to receive a request 'Soft limit' to optimal configuration. Default setting is '10'. Set the maximum amount of time to receive the request header 'Hard limit' to optimal configuration. Default setting is '30'. Set the amount of data, in bytes, to extend the time-out set by the soft limit. Every time the rate is exceeded, the soft limit is increased by one second. The default extension rate is '5000'. Set 'TLS version settings > TLS version' to TLS 1.2. Select the minimum TLS version that is allowed to connect to the WAF. Note that if TLS version 1.2 is selected, clients like Microsoft Internet Explorer 8 or earlier and those running on Window XP won't be able to connect to the WAF. (see the CIS PDF for the remaining steps)

Properties

Operating systems: Any
Tags: sophosthreat-prevention
Reference: CIS Sophos Firewall v22 Benchmark v1.0.0 - 5.5 Ensure Web Application Firewall (WAF) is configured with appropriate protection policies in all the WAF rules in use