dubai web applications and api

Qualys Security Conference Dubai

Dave Ferguson

Director of Product Management, Qualys, Inc.

Web Applications & APIs The Soft Belly of the Cloud

Insecure Apps & APIs

are a Problem

Your business depends on web applications

Any app or API can be a foothold into your

organization

Developers are not incentivized for security

Cloud-based apps are easy for developers to

deploy

Qualys Security Conference 20192 April 29, 2019

➢

➢

U.S. Postal Service (API) . . . . . .

Facebook (API) . . . . . . . . . . . . .

Google+ (API) . . . . . . . . . . . . . .

MyFitnessPal (API?) . . . . . . . . .

Equifax . . . . . . . . . . . . . . . . . . . .

Yahoo . . . . . . . . . . . . . . . . . . . . .

* Source: 2018 Verizon DBIR

Apps & APIs are

Everywhere

April 29, 2019Qualys Security Conference 20193

Public-Facing

Web Apps

Internal Web Apps

Apps in Public Clouds

New Apps

under Development

REST APIs

Web Application Scanning

Qualys Web Application Scanning (WAS)

A leading dynamic application security testing

(DAST) tool

Identifies app-layer vulnerabilities

OWASP Top 10

CWEs

Web-related CVEs

Automated crawling

Supports Selenium scripts

Scans REST APIs

Malware scanning as a bonus


Recent Enhancements

Aug 2018

Sept 2018

Nov 2018

Dec 2018

2018 2019

Jan 2019

Mar 2019


29.04.197

Staging Environment

SourceCode

Repository

Test / QA Environment

Scan

Qualys ScannerAppliance

WASEngine

Dev Environment

API

Scanning with WAS in DevOps

Qualys Security Conference 20197

DEMO: Qualys WAS Jenkins Plugin v2

Manual Testing Complements WAS

Dynamic application scanning is one piece of the AppSec puzzle

Manual penetration testing important for your business-critical apps

Qualys WAS offers:

Bugcrowd integration

Burp Suite integration

Partnerships with consulting companies

9 April 29, 2019Qualys Security Conference 20199

Qualys WAS Burp Extension

10

Burp Suite

A quick, intuitive way to send Burp-discovered issues into WAS

Provides centralized viewing/reporting of WAS detections + Burp issues

Available today in Burp's BApp Store


DEMO: Qualys WAS Burp Extension

WAS Roadmap

12

April 2019

Q3 2019 * 2019 2020

May-June 2019 Q4 2019 *

* Tentative


Web Application Firewall

Qualys WAF

Virtual (inline) reverse-proxy deployed alongside web servers.

Inspects HTTP/S traffic, including Web Services and REST APIs.

Protect against numerous types of attacks including OWASP Top 10.

Out-of-the-box security policies for various application types

User-defined Custom Rules

HTTP profiles (protocol shaping)


Supported

Platforms

Deploy anywhere


Built-in Security Policies

Out-of-the-box rulesets written by Qualys security researchers


User-Defined Custom Rules

Adjust your security policy manually


Load-Balancing and SSL-Offloading

To ease integration with the network environment


Actionable Security Data


WAS / WAF Integration: ScanTrust

20

ScanTrust : Challenge your WAF protection with WASAssess both the application and the policy that protects it

HTTP/S

1. Request inspected and forwarded to backend server

2. WAF annotates HTTP response


WAS / WAF Integration: Virtual Patch

Virtual Patch : One-click mitigation toolPush a custom rule to WAF to block exploit on known vulnerability


Working with WAF as a Container

Container Considerations

Server pools need to be maintained on WAF

Identifying a backend container in advance can be tedious

Need of scalability

Need of automation

Need of security


Virtual Firewall Container (QVFC)

24

Lightweight sensor (350 MB)

Integrates with Docker Service

Dynamic pool automation = Scalability

Orchestration via Qualys API


Benefits of the Docker Integration

Rapid deployment

Bring elasticity to the server pool

Automate with Kubernetes

Secure dynamic assets, dynamically

Simplify backend maintenance operations


Deploy as a Side-Car Proxy

26 April 29, 2019Qualys Security Conference 201926

Or Deploy on PaaS via Kubernetes

27

Kubernetes

Cluster

Container EngineMultiple Instances


Qualys Security Conference Dubai

Thank You

Dave Ferguson

[email protected]

dubai web applications and api

Documents