Wednesday, July 20, 2016

edgescan - Virtual Patching and WAF integration - Reducing "time-to-fix"

What is a Virtual Patch?

The idea of virtual patching is to apply a rule on a perimeter endpoint which mitigates/reduces the risk of the vulnerability being exploited. This can be performed without changing any application source code and is in effect applying a rule to an IDS/IPS or WAF such that it is aware and can defend against a particular attack vector and protect a system from exploitation or breach.

When you consider the numerous use cases when organizations can’t simply edit and fix the source code, the benefits of virtual patching becomes apparent.
  • It is a scalable solution as it is implemented in a single location (the firewall) vs. installing patches on all hosts.
  • It reduces/mitigates risk of breach or exploitation until a vendor-supplied patch is released or while a patch is being tested and applied.
  • The source code is not altered and hence it reduces the likelihood of code conflicts or introducing errors.
  • It provides timely protection for mission-critical systems that may not be taken offline but have an exposed vulnerability.
  • Legacy/3rd Party Apps; The code may not be available but we need to fix the vulnerability.
"Defenders are always on the back-foot as time to fix is longer than time-to-exploit. This slow reaction time creates a permanent offensive advantage to the attacker."

edgescan provides continuous vulnerability managed coupled with expert validation and support via its cloud based SaaS. It manages over 20,000 systems globally every month and provides full-stack vulnerability management to our clients. 

A new feature in edgescan gives or users the ability to generate rules for a chosen firewall vendor/version which are customized to the vulnerabilities unique to the application in question.

  • Auto-generation of firewall rules gives you the ability to patch a critical issue very quickly using your Web Application Firewall.
  • No need to change the applications source code (and maybe that's not possible).
  • Multiple web application vulnerabilities can be mitigated at the same time.
  • No need to be a firewall expert.
  • The edgescan API gives access to automating rule generation and easy deployment to pre-production / production environments.
Generating Virtual Patch rules for an entire application is as simple as hitting the "WAF Rules" button.

Rules generated for Citrix Netscalar
WAF Rules generation for a single selected vulnerability