{"id":30131,"date":"2022-10-26T14:40:33","date_gmt":"2022-10-26T12:40:33","guid":{"rendered":"https:\/\/www.makingscience.com\/?p=30131"},"modified":"2022-10-26T14:40:33","modified_gmt":"2022-10-26T12:40:33","slug":"protect-your-websites-and-applications-with-google-cloud-armor-waf-2","status":"publish","type":"post","link":"https:\/\/www.makingscience.com\/en\/blog\/protect-your-websites-and-applications-with-google-cloud-armor-waf-2\/","title":{"rendered":"Protect your websites and applications with Google Cloud Armor WAF"},"content":{"rendered":"

Web application security is crucial for protecting organisational and client data. In 2021, cyber \u200b\u200battacks caused approximately 5 trillion GBP in damage, which is expected to increase by 15%<\/strong> annually over the next five years<\/strong>. Thus, it is essential to use all possible tools to reduce the risk of these cyber attacks.<\/span><\/p>\n

Google Cloud Armor is a web-application level \u201cfirewall\u201d (WAF) capable of protecting companies from a wide variety of cyberattacks simply and efficiently. To use this tool, we will have to use Google Cloud Platform\u2019s load balancers<\/strong> since that is where Cloud Armor can be enabled on the backend services.<\/span><\/p>\n

\"\"<\/p>\n

 <\/p>\n

Once the load balancer has been configured, and a security policy has been activated for a backend service, it is time to adjust which WAF rules should be applied. There is a wide variety available depending on our needs. The following table shows a list of some of these preconfigured rules grouped by categories:<\/span><\/p>\n\n\n\n\n\n\n\n\n\n
Name of the rule\u00a0<\/b><\/td>\nName of the ModSecurity rule<\/b><\/td>\n<\/tr>\n
sqli-stable<\/td>\nSQL injection<\/td>\n<\/tr>\n
xss-stable<\/td>\nCross-site scripting<\/td>\n<\/tr>\n
lfi-stable<\/td>\nLocal file inclusion<\/td>\n<\/tr>\n
rfi-stable<\/td>\nRemote file inclusion<\/td>\n<\/tr>\n
rce-stable<\/td>\nRemote code execution<\/td>\n<\/tr>\n
scannerdetection-stable<\/td>\nScanner detection<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Each of these rules contains dozens of signatures compiled from <\/span>ModSecurity v3.0.2<\/span><\/a>. Google Cloud Platform (GCP) provides a controlled way to debug<\/strong> these rules with real traffic.<\/span><\/p>\n

The best part is that users are not affected<\/strong> since we can select them in \u201cpreview only\u201d mode. This means that every time one of these rules is triggered, it will be logged and let the traffic through. Obviously, by activating preview mode, we will not be securing our platform in any way. Still, in this way, we can avoid false positives and gradually add these rules.\u00a0<\/span><\/p>\n

In addition to the preview-only mode, GCP uses verbose logging capabilities. What does this mean? For each request blocked by these rules, we will see detailed information in the <\/span>log<\/span><\/a> on which signature and what part of the request has caused the block. As previously mentioned, each of the rules listed in the previous table contains several signatures, so some of these may cause false positives and should thus be disabled.<\/span><\/p>\n

With this protection, we can avoid the following attacks:<\/span><\/p>\n