Detection of Configuration Vulnerabilities in Distributed (Web) Environments

Abstract

Many tools and libraries are readily available to build and operate distributed Web applications. While the setup of operational environments is comparatively easy, practice shows that their continuous secure operation is more difficult to achieve, many times resulting in vulnerable systems exposed to the Internet. Authenticated vulnerability scanners and validation tools represent a means to detect security vulnerabilities caused by missing patches or misconfiguration, but current approaches center much around the concepts of hosts and operating systems. This paper presents a language and an approach for the declarative specification and execution of machine-readable security checks for sets of more fine-granular system components depending on each other in a distributed environment. Such a language, building on existing standards, fosters the creation and sharing of security content among security stakeholders. Our approach is exemplified by vulnerabilities of and corresponding checks for Open Source Software commonly used in today's Internet applications.

Confeagle: Automated Analysis of Configuration Vulnerabilities in Web Applications

“…A language-based approach to specify and execute declarative and unambiguous security checks for detecting vulnerabilities caused by a system misconfiguration is proposed in [14]. The proposed language is based on the SCAP specification [30] and extends the OVAL configuration validation standard [31].…”

“…In the case when configuration vulnerability is considered, it is mostly limited to the deployment environment [12]- [14]. This is a practical bottleneck because an invulnerable deployment environment does not guarantee an invulnerable application from configuration perspective.…”

“…• We put into practice the CCSS to quantify vulnerability scores by introducing additional metric variables relevant to configuration in web applications. • We implemented and evaluated our approach on 14 most widely adopted open source PHP applications and compared its effectiveness with 3 popular web vulnerability scanners. This paper is organized as follows.…”

Policy Chain for Securing Service Oriented Architectures

“…During operations time, the configuration validation [27] component compares the actual system configuration retrieved from the CMDB or from the device itself, possibly changed outside of the PoSecCo scope, with the generated configuration resulting from the top-down refinement process. Discrepancies between the golden and actual configuration are identified and their relevance analyzed and reported.…”