Ensure Web Application Firewall (WAF) is configured with appropriate protection policies in all the WAF rules in use

中等級 2人工審核sophos

說明

Sophos firewall protects web servers against Layer 7 (application) vulnerability exploits. These attacks include cookie, URL, and form manipulation. It can also mitigate common threats such as application and cross-site scripting (XSS) attacks. Sophos firewall provides default policies for some common web services. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

Navigate to 'Protect > Web server > General settings > SlowHTTP protection settings'. Verify that 'Time-out for request headers' is 'ON'. Verify the minimum amount of time to receive a request 'Soft limit' is set to optimal configuration. Default setting is '10'. Verify the maximum amount of time to receive the request header 'Hard limit' is set to optimal configuration. Default setting is '30'. Verify the amount of data, in bytes, to extend the time-out set by the soft limit. Every time the rate is exceeded, the soft limit is increased by one second. (Full steps: CIS 5.5.)

修補方式

修補方法: 操作指南或基礎設施修補檔

Navigate to 'Protect > Web server > General settings > SlowHTTP protection settings'. Set 'Time-out for request headers' to 'ON'. Set the minimum amount of time to receive a request 'Soft limit' to optimal configuration. Default setting is '10'. Set the maximum amount of time to receive the request header 'Hard limit' to optimal configuration. Default setting is '30'. Set the amount of data, in bytes, to extend the time-out set by the soft limit. Every time the rate is exceeded, the soft limit is increased by one second. The default extension rate is '5000'. Set 'TLS version settings > TLS version' to TLS 1.2. Select the minimum TLS version that is allowed to connect to the WAF. Note that if TLS version 1.2 is selected, clients like Microsoft Internet Explorer 8 or earlier and those running on Window XP won't be able to connect to the WAF. (see the CIS PDF for the remaining steps)

屬性

作業系統: 不限
標籤: sophosthreat-prevention
參考資料: CIS Sophos Firewall v22 Benchmark v1.0.0 - 5.5 Ensure Web Application Firewall (WAF) is configured with appropriate protection policies in all the WAF rules in use