Ensure Web Application Firewall (WAF) is configured with appropriate protection policies in all the WAF rules in use

MédiaNível 2Revisão manualsophos

Descrição

Sophos firewall protects web servers against Layer 7 (application) vulnerability exploits. These attacks include cookie, URL, and form manipulation. It can also mitigate common threats such as application and cross-site scripting (XSS) attacks. Sophos firewall provides default policies for some common web services. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).

Como é verificado

Método de auditoria: Revisão manual

Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.

Navigate to 'Protect > Web server > General settings > SlowHTTP protection settings'. Verify that 'Time-out for request headers' is 'ON'. Verify the minimum amount of time to receive a request 'Soft limit' is set to optimal configuration. Default setting is '10'. Verify the maximum amount of time to receive the request header 'Hard limit' is set to optimal configuration. Default setting is '30'. Verify the amount of data, in bytes, to extend the time-out set by the soft limit. Every time the rate is exceeded, the soft limit is increased by one second. (Full steps: CIS 5.5.)

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Navigate to 'Protect > Web server > General settings > SlowHTTP protection settings'. Set 'Time-out for request headers' to 'ON'. Set the minimum amount of time to receive a request 'Soft limit' to optimal configuration. Default setting is '10'. Set the maximum amount of time to receive the request header 'Hard limit' to optimal configuration. Default setting is '30'. Set the amount of data, in bytes, to extend the time-out set by the soft limit. Every time the rate is exceeded, the soft limit is increased by one second. The default extension rate is '5000'. Set 'TLS version settings > TLS version' to TLS 1.2. Select the minimum TLS version that is allowed to connect to the WAF. Note that if TLS version 1.2 is selected, clients like Microsoft Internet Explorer 8 or earlier and those running on Window XP won't be able to connect to the WAF. (see the CIS PDF for the remaining steps)

Propriedades

Sistemas operacionais: Qualquer
Tags: sophosthreat-prevention
Referência: CIS Sophos Firewall v22 Benchmark v1.0.0 - 5.5 Ensure Web Application Firewall (WAF) is configured with appropriate protection policies in all the WAF rules in use