Security is a process
A newspaper report recently warned that many IT products and applications, including payment systems, lack adequate security. The reasons cited are that firstly, security is treated as an afterthought, and secondly, because trained practitioners are not involved in the design and implementation. F5 views security as a process. It should be managed as such. Thereโs an important role for the security experts who build the policies that ensure security and compliance within the organization. And, thereโs an equally important role for the programmers who develop the software. But the two are quite distinct from each other. Business applications are the critical assets of an enterprise. Its security should not be just left to the software engineers to decide because they are not security professionals. Therefore, the prudent approach is to offload the burden of coding security policies from the software programmers onto credible security solutions professionals. Viewed from that perspective, security is as an end-to-end process, with policies to govern the various areas wherever there is user interaction with the enterprise โ device, access, network, application and storage. Given the complexities of the different moving parts, it sometimes makes sense to combine several of the point security concerns into a converged solution. In short, this is akin to process simplification not too different from what consultants would call โBPR" in the business world. However way, you see it, from a CFO perspective, this represents immense cost savings boh operationally as well as in capital costs. For example, when it comes to application security, the trend is to build it into the application delivery controllers. ADCs are designed to natively deliver applications securely to end users. In todayโs context, ADCs act as secured gatekeepers to the applications; they prevent unauthorised access and are able to add-on capabilities to mitigate complex application level attacks such as those defined by OWASP. However, the situation is growing more complex. CIOs are increasingly faced with the task of balancing the needs of a younger, empowered and demanding Gen Y workforce who want the freedom to work from their device of choice as well as the ability to switch seamlessly between their social and enterprise networks. The CIO challenge is how to protect the companyโs business assets in the face of increasing and more complex threats. Add to this the desire to leverage the cloud for cost control and scale and the security considerations can potentially spiral out of control. The situation calls for innovative security solutions that can understand the behaviour of enterprise applications as well as user behaviour, and be able to enforce corporate security policies effectively with minimum impact on user experience. F5 believes that security is a trust business. Having the right process and policies trumps choosing a vendor. It is the policies and process that determine the required solution, not vice versa. For a Japanese version of this post, please go here.
Who needs a Bot Army these days?
Itโs been a while - a long while - since I last (officially) blogged. Too many distractions with a new role, new travels, and a new family member - sucks away the creative juices. Alas, sitting at an airport lounge after a 3 city Security Roadshow in Bombay/Delhi/Bangalore brings out the adrenaline rush of blogging once more. Iโve been evangelizing the need for DoS protection for quite a while. Events of last year (2013), and even the beginning of 2014, have made my job easier (Happy New Year!). I used to equate DoS (rather Distributed DoS) attacks with Bot Armies - kinda like the Orcs that we saw in the LOTR (Lord of the Rings**) saga. The Bots (Orcs) still exist - but seems like the Bot Herder (Iโll call him โSauronโ **) is summoning a new type of Army these days - a new generation of orcs used to carry out his mission to wipe a particular service/server from the face of the Internet world - You and Me! Yes - US! Who needs a Bot Army these days? There are gazillions of Internet users and servers out there. There isnโt a need for any kind of endpoint infection/malware. That would be troublesome. All you need is an unsuspecting (and poorly protected) + popular web server, and some programming flair with JavaScript (JS) or iFrames. Then you need to compromise that popular web server and input the malicious JS/iFrame into the landing web page. So when a user visits this compromised popular website (e.g. an online gossip portal) to read about the latest Hollywood gossips, the hidden JavaScripts or iFrames gets executed within his browser and causes him to send multiple GET requests to the victim. And the victim gets hoarded with a torrent of GET requests, and if its not sufficiently and appropriately protected, guess what happens? Bam! 2014 began with an interesting new type of attack against a couple of gaming sites like League of Legends, Steam and Battle.net using yet another type of โbotnetโ, except that these werenโt bots but actual Network Time Protocol (NTP) servers. The NTP protocol is used by many servers and endpoints to sync system clocks - for example my mac uses time.asia.apple.com. Leveraging the inherent โtrustโ that the UDP protocol exhibits (aka stateless), and a relatively forgotten command called โmonlistโ, this is how it works. From my laptop, a small query of 234bytes returns a response of 100 packets each of 482bytes, producing an amplification factor of approximately 205x (you get the hint). So I need to be armed with a list of open and unpatched NTP servers (which isnโt difficult to find - there are automated programs out there that can โassist"), and spoof the IP address of someone whom I donโt like, and shazam. An example of the now infamous โmonlistโ command for an unpatched NTP server looks like: This reminds me of the DNS Reflective Amplification attacks during the Cyberbunker-Spamhaus saga in March of last year (2013). Again, the trust model of the DNS protocol was exploited, and what that didnโt help with the problem were those 20-something million open DNS resolvers which neither perform any kind of filtering nor any request verification or traffic management of DNS responses. And as a result, 300Gbps of DNS responses towards an unsuspecting victim, which even caused collateral damage to International Peering exchanges. Now, how do we deal with these? For the DNS and NTP reflective amplification attacks, apart from deciding to not be an open DNS resolver, or disabling the โmonlistโ command, if you are a service or hosting provider to one of these potential โOrcsโ, one simple way is to monitor the outbound BPS/PPS/Number of connections originating from the server. When it gets anomalously high, move to the next step of monitoring perhaps the Top 10 destinations these guys are sending towards. It doesnโt make sense that a DNS server out there is sending 1M DNS โAnyโ responses per second to www.f5.com. Apply an appropriate rate shaping policy as needed and that will help protect your own network infrastructure, save some peering/transit costs, and help the poor victim. The HTTP reflection attack is a bit more challenging, given that as mentioned previously - it isREALHTTP traffic fromREALbrowsers out there. You canโt filter based on malformed HTTP packets. You canโt filter based on URL since itโs typically a legitimate URL. This calls for Anti-Bot Intelligence, like: TCP SYN Cookie verification (L4) HTTP Redirection verification (L7) JavaScript / HTTP Cookie verification (L7) CAPTCHA verification (L7) With the ability to step-up countermeasures dynamically and when needed. Of course, the latter verification methods are higher in the OSI stack (Layer 7), more advanced and computationally more expensive to perform. Here at F5, weโve found that (3) and (4) have been extremely effective in terms of combating DoS tools/scripts and even the hidden JavaScripts/iFrames mentioned above. These guys typically bail out when it comes to solving complex JavaScript puzzles or checking of mouse/keyboard movements etc., and not to mention solving CAPTCHA puzzles. Once this happens, throw the errant source into a penalty box for a period of time, then repeat the rinse and lather. Dynamically increase this penalty box timeout when the errant source fails multiple times. This will effectively thwart any attempt from the errant source in sending HTTP requests to the victim server. Lastly, work with your upstream service provider, or engage a cloud-based anti-ddos service when the attacks become too large to handle. Sound the SOS! It is common-sense the only possible way to mitigate 300Gbps floods is in the service provider cloud / cloud-based anti-ddos service, likely using a distributed scrubbing โanycastโ model, where each distributed scrubbing center sucks in the traffic destined for the victim like a big washing machine and starts cleaning. That said, there are many ways to skin a cat - likewise, there are many ways to solve a DoS problem. Pay particular attention to attacks as they move up the OSI stack toward Layer 7. These are typically harder to mitigate, but fortunately not for F5. So if youโre thinking that botnet armies are the Sole source of menace in the DoS world out there, theyโre not. Everyday Internet users like you and me could be an unsuspecting participant in the worldโs largest DoS to be. ** Source: The Lord of the Rings, J.R.R Tolkien, 1954
APAC market research points to WAF being integrated with application delivery
We entered 2014 on a fillip. Frost & Sullivan had just named us the vendor leading WAF market in Asia Pacific and Japan. The Frost Industry Quotient, put F5 and nine other companies under their analytical magnifying glass, examining our market performance for CY 2012 as well as key business strategies. They left no strategy unturned it would seem. Product and service strategy, people and skills strategy, business and even the ecosystem strategy were all held up to scrutiny. But the real scoop wasnโt that we were No 1 but that Frost IQ had discerned developments in the market that point towards WAF being integrated with application delivery. The researchers noted that the convergence would lead to a more intelligent and holistic way for organizations to protect their web applications. The market is validating what we said a year ago when we launched BIG-IP Advanced firewall Manager, the first in the industry to unify a network firewall with traffic management, application security, user access management and DNS security capabilities within an intelligent services framework. Every day, publicly known or otherwise, organizations grapple with attacks that target their applications in addition to those that threaten the network. Because F5 solutions occupy strategic points of control within the infrastructure, they are ideally suited to combine traditional application delivery with firewall capabilities and other advanced security services. The bell tolls for the traditional firewall. Eventually it will be replaced by intelligent security. F5โs integrated approach to security is key in mitigating DDoS attacks, helping to identify malicious actions, prioritize how requests from specific locations are handled and focus on addressing properly qualified requests. Enabling security services on our ADCs makes it possible to consolidate multiple security appliances into one single device. This consolidation includes a WAF that analyses traffic and can propose rules to automatically protect the enterprise. I caught up quickly with Christian Hentschel, SVP Asia Pacific and Japan, on his views of the new accolade. Aside from being very proud to be recognized as the leading WAF vendor in APJ, a testimony of our strategy and the teamโs focus, he noted that customers view traditional firewall less relevant with the sophistication in cyber-attacks on layer 4-7 today.Tackling Cyber Attacks From Within
An increasing number of organizations face serious security threats that are socially, politically and economically motivated. Conventional firewalls are no longer enough to prevent complex and frequent cyber attacks such as multi-layer distributed denial-of-service (DDoS)/application layer attacks and SQL injection vulnerabilities. In the past year, the number of DDoS attacks targeting vulnerable spots in web applications has risen and attackers are using increasingly complicated methods to bypass defenses. Meanwhile, 75% of CISOs aware external attacks had increased โ 70% of CISOs noticed that web applications represent an area of risk higher than the network infrastructure. The challenge with application-layer attacks is to differentiate human traffic from bot traffic. DDoS mitigation providers frequently utilize browser fingerprinting techniques like cookie tests and JavaScript tests to verify if requests are coming from real browsers. However, most recently, itโs become apparent that cybercriminals have launched DDoS attacks from hidden, but real browser instances running on infected computers. This type of complex cyber attack is incredibly hard to detect. What organizations need is a security strategy that is flexible and comprehensive, much like F5โs web application firewall (WAF) and security solution. F5 recently received the 2013 Frost & Sullivan Asia Pacific Web Application Firewall Market Share Leadership Award. This recognition demonstrates excellence in capturing the highest market share for WAF solutions in the region and its achievement in remarkable year-on-year revenue growth โ a true testimony to the execution of F5โs security strategy. Christian Hentschel, (SVP, APJ) noted that cyber-attacks often result in the loss or theft of intellectual property, money, sensitive corporate information, and identity. An effective security strategy encompasses not only the enterprise infrastructure but also the devices, the applications, and even the networks through which users access mobile and web applications. F5โs ICSA-certified WAF and policy-based web application security address cyber-threats at the application level. In September 2013, F5 strengthened its security portfolio with the acquisition of Versafe Ltd. โ a web anti-fraud, anti-phishing, and anti-malware solutions provider. The acquisition reinforces F5โs commitment to provide organizations with holistic, secure access to data and applications any time, from any device. F5โs comprehensive security solutions combine DNS security and DDoS protection, network firewall, access management, and application security with intelligent traffic management. Its flexibility to provide WAF both as a standalone solution and as an integrated offering on its BIG-IPยฎ Application Delivery Controller platform provides customers with options that best suit their businesses. F5โs ability to provide end-to-end application protection, advanced monitoring, and centralized management without comprising performance make their WAF solutions the number one choice throughout the Asia Pacific region.F5 predicts: The dumb firewall will become obsolete
Based on Gartnerโs prediction, by 2016, the financial impact of cybercrime would grow by 10 per cent per year, due to the continuing discovery of new vulnerabilities fuelled by the increasing adoption of mobile collaboration platforms and cloud services. Another study, titled The 2013 Cost of Cyber Crime Study, reveals that the cost of cybercrime in 2013 escalated 78 percent, while the time necessary to resolve problems has increased by nearly 130 percent in four years. This fundamentally results in the need for organizations to rethink the security defenses that is being deployed to protect their IT infrastructure. Most organizations typically rely on traditional security solutions like network firewalls, Intrusion Prevention Systems (IPS) or antivirus software that monitor network traffic and/or system activities for malicious activity. Today's threat landscape encompasses an increasing range of potential vulnerabilities and demands an appropriately sophisticated response by those charged with cyber defence responsibilities โ whether in the family, organization or at the national level. The proliferation of Internet connectivity has allowed malicious software to spread in seconds to millions. And the malware itself has become much better at avoiding detection, taking steps to hide its signature. Most viruses today are obfuscated a number of times and checked to make sure no anti-virus software can detect it - all in a matter of seconds, and all before it's sent out to its victim. Sensitive data is facing new security threatsโevidenced by all the application targeted cyber attacks we see in the news. High profile attacks, such as the Adobe data breach, attack by The Messiah in Singapore, the recent multi-layer distributed denial of service attacks, SQL injection vulnerabilities, and JSON payload violations in AJAX widgets, pose increasing risks to interactive web applications, data, and the business. Internet threats are widely varied and multi-layered. As these threats evolve, organizations find that traditional firewalls lack the intelligence and the scalability needed to stay effective and responsive under a multi-layered persistent threat scenario. Security practitioners are coming to grasps with the new paradigm of having to handle enterprise security as an end-to-end process from end-user device to networks to applications. The days of finding comfort behind a solitary firewall or a unified threat management device are gone with the current threat landscape. IT staff should be aware that any security solution should be able to handle attacks on multiple levels โ i.e. at the network and at the application โ providing a defense in depth; simple firewalls will easily be overwhelmed by the scale of the attacks that are experienced by enterprises today. "The threats that exist today are getting through many of today's existing security controls," warns Gartner Inc. analyst and Research Director Lawrence Pingree. "Advanced threat protection appliances that leverage virtual execution engines as a petri dish for malware are most effective to deal with the latest threats. Also, organizations must continue to upgrade their endpoint protection suites.โ โIntelligent securityโ is becoming more important as cyber criminals become more sophisticated, and this is leading to the rise of security that is flexible and responsive based on factors such as the apps, location or the user. Ultimately, the right tool needs to be tailored for the right attack. One thing is clear: A one-size-fits-all approach to security won't work in 2014 and beyond. At the same time, security cannot be at the expense of performance. End-users are expecting high performance and security cannot be a bottleneck. Much alike the saying that no service can be โgood, cheap and fastโ, most security practitioners are looking for the ideal solution for an ever changing problem. But in reality we know that there cannot be one solution which can fulfil all requirements and be 100% foolproof. Like how insurance needs evolve over a personโs lifetime, security requirements also evolve over the enterprise business lifecycle. Therefore it is important to adopt an architectural approach to security which continually evolves as the landscape changes. Again remember that security is a function of people, process and technology and without the optimal use of the 3 components, 100% protection could be like a search for the Holy Grail! What is your view on the changing security landscape? Tell us in the comments below.F5 predicts: Social Adoption opens up security risks
Kicking off the โF5 predictionsโ series is a topic that is proving difficult for businesses to ignore: the avalanche of social technologies coming into the enterprise. Many companies understand the value technology brings, such as increased productivity, a more efficient workplace and better collaboration between colleagues and departments, greater brand experience between customers and companies. Many companies are also witnessing an evolving market. Notably, the demand from Generation Y and Z is or a more socialized work environment. Taking Singapore as one example, the figure has been put at 60% of the workforce. This new breed emerges as the largest age group since the baby boomer generation: they are well-educated, well-traveled, tech-savvy, able to multi-task and reaching out for social interaction, Millenials urge even the most traditional companies to deploy a more collaborative and socialized environment. Catering to this new breed of employees, managers need to fully understand the user behavior whilst introducing refreshed guidelines to ensure a secure social environment at work. To the customers, companies need to understand the user behavior to generate business and brand loyalty in a secured environment. And security is in fact the Achillesโ heel in companies, according to Ernst & Youngโs Global Information Security Survey 2013. The number of security incidents increased according to thirty-one percent of the respondents by at least 5% over the last 12 months. Further, the survey indicates that security functions arenโt fully meeting the needs in 83% of organizations. Companies are eager to protect themselves against cyber-attacks, be it for reputation, revenue, and accountability reasons. It is a step in the right direction, as by not taking security risks into consideration, companies become an easy target for cyber attackers, which can probably jeopardize an organizationโs reputation. Security is one of the top hurdles in organizations adopting new technologies. Formerly, they have been able to keep data behind their walls and have control over it. But with newer technologies, customer data is more exposed. The number of security breaches is on the rise. Nonetheless, the pace of technology evolution will only accelerate โ such as with the โsocialโ demands of these younger cohorts. Millennials will soon dominate the workforce โ just the same way Baby Boomers did once. This tech-savvy and highly mobile generation grew up with the Internet and expects readily available information for work and for pleasure on their mobile devices, as they already have on a typical desktop computer. And soon these younger cohorts are going to be the biggest customer group, conducting their lives in the virtual space. Together, the technology and the customer demand of this newest group drive a transformation of how different sectors act. Looking at the banking sector, Millennialsโ expectations are to have access to the services, transact, any time and anyhow. Mobility strategy is not an easy endeavor for any company. Areas of consideration include access to applications and data, balance of security policies and user convenience, speed to provide needed information or complete a transaction, ease of browsing, etc. For most enterprises it is a time and resource-absorbing task to manifest mobile applications and to maintain these. What businesses need is a backend infrastructure that can help deliver image-heavy content, prioritize traffic to overcome mobile network latency, offer visibility into application performance, all these while keeping web vulnerabilities low. Furthermore, as cyber crime becomes more complex, with attacks from multiple angles on different devices, single-purpose security machines will be phased out in favor of sophisticated multi-purpose machines. This convergence will also happen in the context of performance, as businesses come to expect fast, reliable user experience on any device.Leave No Application Behind
F5์ ์๋ก์ด ์ํคํ ์ฒ ๋น์ Synthesis ๊ทธ๋ฆฌ๊ณ F5 ์ฝ๋ฆฌ์์ ๊ด๋ชฉํ ๋งํ ์ฌ์ ์ฑ๊ณผ์ ๋น์ F5 ๋คํธ์์ค ์ฝ๋ฆฌ์๋ ์ง๋ 1์ 27์ผ ๊ธฐ์๊ฐ๋ดํ๋ฅผ ์ด์ด ์ํํธ์จ์ด์ ์ ์ ํ๋ฆฌ์ผ์ด์ ์๋น์ค(SDAS)๋ฅผ ์ ๊ณตํ๋ ์๋ก์ด ์ํคํ ์ฒ ๋น์ โF5 Synthesisโ๋ฅผ ์ค๋ช ํ๊ณ , F5 ์ฝ๋ฆฌ์์ ๊ด๋ชฉํ ๋งํ 2013๋ ๋น์ฆ๋์ค ์ฑ๊ณผ์ 2014๋ ๊ณํ์ ์๊ฐํ๋ ์๋ฆฌ๋ฅผ ๊ฐ์ก๋ค. ๋น์ผ ๋ฐํ๋ F5 ์ฝ๋ฆฌ์ ์กฐ์๊ท ์ง์ฌ์ฅ๊ณผ ์์์ ํํ์ ์ง์ญ ์ ํ ๋ง์ผํ ์ด๊ด ์ฑ ์์ ์ผ์ด์น๋ก ๋ ธ์ํค(Keiichiro Nozaki)์จ๊ฐ ํจ๊ป ํ๋ค. F5๊ฐ ์ง๋ ํด 11์ ๋ฐํํ F5 Synthesis๋ ํ๋ ฅ์ ์ธ ๊ณ ์ฑ๋ฅ ๋ฉํฐ-ํ ๋ํธ ์๋น์ค ์ํคํ ์ฒ์ ๊ธฐ๋ฐํด ๋ฐ์ดํฐ์ผํฐ, ํด๋ผ์ฐ๋, ํ์ด๋ธ๋ฆฌ๋ ํ๊ฒฝ ๋ชจ๋์ ๊ฑธ์ณ SDAS์ ์ ๊ณต ๋ฐ ํตํฉ์ ์ฉ์ดํ๊ฒ ๋ง๋๋ ์ํคํ ์ฒ ๋น์ ์ผ๋ก ํ์ฌ๊น์ง F5 ๊ธฐ์ ์ด ์ด๋ฃฉํ ํ์ ์ ์ ์ ์ด๋ผ ํ ์ ์๊ฒ ๋ค. ์๋กญ๊ฒ ๋์ ํ ๋ผ์ด์ ์ค ์ต์ ๋ค๊ณผ์ ๊ฒฐํฉ์ผ๋ก ๋ฐํ๋ F5 Synthesis๋ ๊ณ ๊ฐ๋ค์ด ๋ ์ด์ด 4-7 ์๋น์ค๋ฅผ ์ด๋ ๋๊ตฌ์๊ฒ๋ , ์ ์ฝ ์์ด, ๋น ๋ฅด๋ฉด์๋ ๋น์ฉ ํจ์จ์ ์ผ๋ก ์ ๊ณตํ ์ ์๋๋ก ๋ง๋ค์ด์ค๋ค. F5 Synthesis๋ ๊ณ ์ฑ๋ฅ ์๋น์ค ํจ๋ธ๋ฆญ์ผ๋ก ๊ฐ์ฅ ๊น๋ค๋ก์ด ํ๊ฒฝ์์์ ์๊ตฌ์กฐ๊ฑด์ ์ถฉ์กฑํ๋๋ก ํ์ฅ์ด ๊ฐ๋ฅํด, ๊ด๋ฆฌ ๋๋ฉ์ธ๊ณผ ๊ฐ์ ์ธ์คํด์ค ๋ํฉ 20.5TB์ ์ฒ๋ฆฌ์๋์ 92์ต ๊ฑด์ ์ปค๋ฅ์ ์ฉ๋์ ์ง์ํ๋๋ฐ, ์ด๋ ํ์ฌ ์ ์ธ๊ณ ๋ชจ๋ ์ธํฐ๋ท ์ฌ์ฉ์๋ค์ ์ฐ๊ฒฐ์ ๊ด๋ฆฌํ๋๋ฐ ํ์ํ ์ฉ๋์ 3๋ฐฐ๊ฐ ๋๋ ์์น์ด๋ค. F5๊ฐ Synthesis๋ฅผ ํตํด ์๋กญ๊ฒ ๋ด์ธ์ฐ๊ณ ์๋ โLeave No Application Behind/ ๋จ ํ๋์ ์ ํ๋ฆฌ์ผ์ด์ ๋ ๋น ๋จ๋ฆฌ์ง ๋ง๋ผโ๋ ๋ฉ์์ง๋ฅผ ๋ท๋ฐ์นจํด์ฃผ๋ ์์น์ด๊ธฐ๋ ํ๋ค. ํํธ, ํ์ฅ์์๋ ์ฐธ์ ๋ฏธ๋์ด์ ๋ฌธ์์ ๋ฐ๋ผ F5 Synthesis๊ฐ ์์ฅ์ ์ ์ฉ๋ ์ ์๋ ์ผ๋ จ์ ๋ ํผ๋ฐ์ค ์ํคํ ์ฒ๊ฐ ์ ๋ณด์ฌ์ก๋๋ฐ, ์ด๋ค์ ๊ณ ๊ฐ๋ค์ด ์ดํดํ๊ธฐ ์ฝ๋๋ก ๋น์ฆ๋์ค ์๋ฃจ์ ์ ์ด์ ์ ๋ง์ถ๊ณ ๊ณ ๊ฐ๋ค์ด ์์ฅ ์ง์ถ ์๊ฐ์ ๋จ์ถํ์ฌ ๋๋ฆฌ ํผ์ ธ์๋ ๋์ ๊ณผ์ ๋ค์ ํด๊ฒฐํ ์ ์๋๋ก ๋์์ธ๋์ด ์์๋ค. F5 ์ฝ๋ฆฌ์์ ์กฐ์๊ท ์ง์ฌ์ฅ์ โF5๋ ๋น ๋ฅด๊ฒ ๋ณํํ๊ณ ์๋ ADC ์์ฅ์ ์์ง์์ ์ ์ธ์ํ๊ณ ์๊ณ , ์ด๋ฏธ ๊ธ๋ก๋ฒ ๋ฆฌ๋์ญ ์ ์ง๋ฅผ ํ๊ณ ํ ํ๊ณ ์๋ค. ์ฐ๋ฆฌ๋ ๊ธฐ์ ์ด ์์ญ์ต์ ์ฌ์ฉ์์ ๋๋ฐ์ด์ค, ๊ทธ๋ฆฌ๊ณ ์ ๋ฐฑ๋ง ์ข ์ ์ ํ๋ฆฌ์ผ์ด์ ๋ฑ IT๊ฐ ํฅํ๊ณ ์๋ ๋ฐฉํฅ์ผ๋ก ๋๊ฐ ์ ์๋๋ก ๋๋๋ค. ์ค๋์ ๋ฐํ๋ ์กฐ์ง๋ค์ด ์ง๋์น ๋ณต์ก์ฑ์ผ๋ก ์ด๋ ค์์ ๊ฒช๊ฑฐ๋ ์ ํ๋ฆฌ์ผ์ด์ ์ฑ๋ฅ๊ณผ ๋ณด์์ ํฌ์์ํค์ง ์์ผ๋ฉด์ ์ค๋๋ ์ ํฅ๋ฏธ์ง์งํ๊ณ ํ๊ธฐ์ ์ธ ๊ธฐ์ ๋ค์ ํ์ฉํ๋๋ก ๋์์ฃผ๊ธฐ์ F5๊ฐ ์ด์์ ์ธ ์์น๋ฅผ ์ ํ๊ณ ์๋ค๋ ์ฐ๋ฆฌ์ ๋ฏฟ์์ด ๋ฐ์๋ ๊ฒ์ด๋คโ๊ณ ๊ฐ์กฐํ๋ค. ๊ฐํธ๋๋ 2013๋ 3์ 18์ผ ๋ฐ๊ฐํ โ์ฑ๋ฅ์ ๊ฐ์ ํ๊ณ ๋น์ฉ์ ์ ๊ฐํ๊ธฐ ์ํ ๋คํธ์ํฌ ๋์์ธ์ 5๋ ์์โ๋ผ๋ ๋ณด๊ณ ์์์ โ์ ํ๋ฆฌ์ผ์ด์ ํ๊ฒฝ, ์ฌ์ฉ์์ ๊ธฐ๋์น, ๋คํธ์ํฌ ์๋น์ค ๋ฑ์ ๋ณํ๋ก ์ธํด ๋คํธ์ํฌ ์ค๊ณ์๋ค์ ์ฌ๊ณ ๋ฅผ ๋ํ ๋คํธ์ํฌ๊ฐ ์๋กญ๊ณ ๋ณํํ๋ ์ฌ์ ์์ ์๊ฑด๋ค์ ์ง์ํ๋๋ก ๋ง๋ค ๊ฒ์ด ์๊ตฌ๋๋ค. ๊ทธ๋ค์ ๋ด๋ถ์ ๊ทธ๋ฆฌ๊ณ ์ธ๋ถ์ ์ผ๋ก ๊ด๋ฆฌ๋๋ ๊ธฐ์ ์ฉ ์ ํ๋ฆฌ์ผ์ด์ ๋ค์ ๊ฐ์ฅ ์ ์ง์ํ๋ ํ๋ ์์ํฌ ๋ด์์ ์ฌ์ฉ์, ์ ํ๋ฆฌ์ผ์ด์ , ๋๋ฐ์ด์ค, ์์น, ํ๋ ๋ฑ ๋ค์ฏ ๊ฐ์ง ์์๋ฅผ ์ ํด๊ฒฐํด์ผ ํ ํ์๊ฐ ์๋คโ ๊ณ ๋ฐํํ ๋ฐ ์๋ค.ใปใญใฅใชใใฃใฏใใญใปในใงใใ
ๆจไปใฎๆฐ่่จไบใซใใใฆใๆฏๆใใทในใใ ใๅซใใIT่ฃฝๅใใขใใชใฑใผใทใงใณใฎๅคใใๅๅใชใปใญใฅใชใใฃๆฉ่ฝใๆใใฆใใชใใจใใ่ญฆๅใใใใพใใใ็็ฑใจใใฆใใพใใปใญใฅใชใใฃใฏๅพไปใใจใใ่ใใใใใจใใใใจใไบใค็ฎใซใฏใปใญใฅใชใใฃใฎๅฐ้็ฅ่ญใๆใฃใไบบใฏใใใถใคใณใใใใใฎ่ฃฝๅใพใใฏใขใใชใฑใผใทใงใณใฎๅฎๆฝใซ้ขใใฃใฆใใชใใจใใใใจใๆใใใใฆใใพใใ F5ใฏใใปใญใฅใชใใฃใใใญใปใน๏ผ้็จ๏ผใจๆใใใใฎใใใซ็ฎก็ใใใในใใงใใใจ่ใใฆใใพใใ็ต็นใฎไธญใงใปใญใฅใชใใฃใจใณใณใใฉใคใขใณในใๆฉ่ฝใใใใใใฎใใชใทใผใ็ฏใใปใญใฅใชใใฃใฎๅฐ้ๅฎถใซใฏ้่ฆใชๅฝนๅฒใใใใพใใใใใจๅๆงใซใใฝใใใฆใงใขใ้็บใใใใญใฐใฉใใผใซใ้่ฆใชๅฝนๅฒใใใใพใใใไบใคใฎๅฝนๅฒใฏๆง่ณชใ้ใใพใใ ใใธใในใขใใชใฑใผใทใงใณใซใใใใปใญใฅใชใใฃใใชใทใผใฎๆฑบๅฎใฏใใฝใใใฆใงใขใจใณใธใใขใซๅงใญใใใในใใงใฏใใใพใใใใชใใชใใๅฝผใใฏใปใญใฅใชใใฃใฎๅฐ้ๅฎถใงใฏใชใใใใงใใใใฎใใใๅ ๅฎใชๆนๆณใจใใฆใฏใใฝใใใฆใงใขใใญใฐใฉใใผใใใปใญใฅใชใใฃใใชใทใผใฎใณใผใใฃใณใฐไฝๆฅญใฎ่ฒ ๆ ใๆธใใใไฟก้ ผใงใใใปใญใฅใชใใฃใฝใชใฅใผใทใงใณใใญใใงใใทใงใใซใซ่จใใจใใใใจใงใใ ใคใพใใใปใญใฅใชใใฃใใจใณใใใผใจใณใใฎใใญใปในใงใใใจ่ช่ญใใใใใคในใงใใใใขใฏใปในใงใใใใใใใฏใผใฏใใขใใชใฑใผใทใงใณใใใผใฟใฎไฟๅญใงใใใไผๆฅญใจใฆใผใถใผ้ใงไบคๆตใใใใจใชใขใซใฏใฉใใซใงใใปใญใฅใชใใฃ็ฎก็ใฎใใชใทใผใๅฟ ่ฆใงใใใใใใใฎใใผใใฎ่ค้ๆงใ่ๆ ฎใใใจใใใใคใใฎใปใญใฅใชใใฃใฎๆธๅฟตใๅ ฑๆใฎใฝใชใฅใผใทใงใณใซใพใจใใๆนใใใๅ ดๅใใใใพใใ่ฆใฏใใใฎใใใชๆนๆณใงใปใญใฅใชใใฃใใญใปในใ็ฐก็ด ๅใใใใจใฏใใณใณใตใซใฟใณใใใใธใในใฎไธ็ใงไฝฟใ โBPRโ (business process re-engineering: ใใธใในใใญใปในใปใชใจใณใธใใขใชใณใฐ)ใฎใใใชใใฎใงใใCFO๏ผๆ้ซ่ฒกๅ่ฒฌไปป่ ๏ผใฎ่ฆณ็นใใใใใจใ้ๅถ้ขใใใ่ณๆฌ้ขใใ่ฆใฆใใใใใฏ่ซๅคงใชใณในใๅๆธใซใคใชใใใพใใ ไพใใฐใใขใใชใฑใผใทใงใณใปใญใฅใชใใฃใฎๅ ดๅใใใฌใณใใชใฎใฏใใขใใชใฑใผใทใงใณใใชใใชใณใณใใญใผใฉใผ(ADCs)ใฎไธญใซใปใญใฅใชใใฃๆฉ่ฝใ็ตใฟ่พผใใใจใงใใADCsใฏใใจใใจใใขใใชใฑใผใทใงใณใๅฎๅ จใซใจใณใใฆใผใถใซๅฑใใใใซ่จญ่จใใใฆใใพใใไปๆฅใฎๆ่ใงใฏใADCsใฏใขใใชใฑใผใทใงใณใฎใใใฎใฒใผใใญใผใใผใฎใใใชๅฝนๅฒใๆใใใพใใๆจฉ้ใฎใชใใขใฏใปในใ้ฒใใOpen Web Application Security Project (OWASP)โปใซใใๅฎ็พฉใใใใใใช่ค้ใชใขใใชใฑใผใทใงใณใฌใใซใซๅฏพใใๆปๆใ้ฒๅพกใใใใจใใงใใพใใ ใใใใ็ถๆณใฏใใใซ่ค้ใซใชใฃใฆใใฆใใฆใCIO๏ผๆ้ซๆ ๅ ฑ่ฒฌไปป่ ๏ผใฏใไปใฎ่ชฒ้กใซใ็ด้ขใใฆใใพใใ่ฟๅนดใฎ่ฅใๅพๆฅญๅกใฏใๅพๆฅญๅกใจใใฆใฎๆจฉๅฉใไธปๅผตใใ่ฆๆฑใๅคใใชใฃใฆใใฆใใพใใ่ชใใ้ธๆใใใใใคใน๏ผใฟใใฌใใใในใใผใใใฉใณ็ญ๏ผใ่ช็ฑใซ้ธๆใใฆไปไบใใใใใจใใๅฝผใใฎ่ฆๆฑใซๅฟใใคใคใ่ช่บซใฎSNSใจ่ทๅ ดใงใฎใใใใฏใผใฏใใทใผใ ใฌในใซๅใๆฟใใใใจใใๅฝผใใฎ่ฆๆใซใ็ญใใชใใใฐใชใใพใใใCIOใซใจใฃใฆใฎ่ชฒ้กใจใฏใ่ ๅจใฎๅขๅ ใจ่ค้ๅใๅใซใใใใซใใฆไผๆฅญใฎ่ณ็ฃใๅฎใใใจใใใใจใงใใๅ ใใฆใCIOใฏใณในใ็ฎก็ใฎใใใซใฏใฉใฆใใ็ฉๆฅต็ๅฉ็จใใใใจ่ใใฆใใพใใใใฎใใใชCIOใฎๅธๆใจใปใญใฅใชใใฃไธใฎ้ ๆ ฎใไธก็ซใใใใจใฏ้ฃใใใ็ฎก็ไธ่ฝใช็ถๆณใซ้ฅใๅฏ่ฝๆงใใใใพใใ ใใฎ็ถๆณใซๅฟ ่ฆใชใฎใฏใใฆใผใถใผใฎๆถ่ฒป่กๅใซๅ ใใฆไผๆฅญใขใใชใฑใผใทใงใณใ็่งฃใใใฝใชใฅใผใทใงใณใงใใๅ ใใฆใใฆใผใถใผใฎไฝฟ็จ็ฐๅขใธใฎๅฝฑ้ฟใๆๅฐ้ใซใจใฉใใคใคใไผๆฅญใฎใปใญใฅใชใใฃใใชใทใผใๅฎๆฝใใใใจใๅฟ ่ฆใจใชใใพใใF5ใฏใปใญใฅใชใใฃใไฟก้ ผใฎใใธใในใ ใจ่ใใฆใใพใใๆญฃใใใใญใปในใจใใชใทใผใๆใฃใใใณใใผใ้ธๆใใใใจใ้ๅธธใซ้่ฆใงใใใใชใทใผใจใใญใปในใๅฟ ่ฆใชใฝใชใฅใผใทใงใณใๆฑบๅฎใใใฎใงใใฃใฆใใใฎ้ใงใฏใชใใฎใงใใ โปOpen Web Application Security Project (OWASP): ใฆใงใใขใใชใฑใผใทใงใณใปใญใฅใชใใฃใใจใใพใ่ชฒ้กใ่งฃๆฑบใใใใจใ็ฎ็ใจใใใๅฝ้็ใชใชใผใใณใชใณใใฅใใใฃhttp://appsecapac.org/2014/owasp-appsec-apac-2014/about-owasp/ใ For an English version of this post, please click here.๋ณด์์ ๊ณผ์ ์ด๋ค.
์ต๊ทผ ํด์ธ์ ๊ถ์ ์๋ ํ ์ ๋ฌธ์ ๊ฒฐ์ ์์คํ ์ ํฌํจํ ๋ง์ IT ์ ํ๋ค๊ณผ ์ ํ๋ฆฌ์ผ์ด์ ๋ค์ด ์ ์ ํ ๋ณด์์ ๊ฐ์ถ๊ณ ์์ง ๋ชปํ๋ค๊ณ ๊ฒฝ๊ณ ํ๋ค. ์ด ์ ๋ฌธ์ ์ฒซ์งธ, ๋ณด์์ด ์ต์ฐ์ ์ ์ธ ๊ณ ๋ ค์ฌํญ์ผ๋ก ๊ฐ์ฃผ๋์ง ์๊ณ ์์ผ๋ฉฐ, ๋์งธ๋ ์์คํ ์ ๋์์ธ ๋ฐ ๊ตฌํ์ ๋ณด์ ์ ๋ฌธ๊ฐ๋ค์ด ๊ด์ฌํ๊ณ ์์ง ์๊ธฐ ๋๋ฌธ์ด๋ผ๊ณ ๊ทธ ์ด์ ๋ฅผ ๋ฐํ๋ค. F5 ๋คํธ์์ค๋ ๋ณด์์ ์ผํ์ฑ์ ์กฐ์น๋ ํ์๊ฐ ์๋ ์ผ๋ จ์ ๊ณผ์ ์ผ๋ก ์๊ฐํ๊ณ ์์ผ๋ฉฐ, ๋ณด์์ ์ด๋ฐ ๊ด์ ์์ ์ ๊ทผ๋์ด์ผ ํ๋ค. ์กฐ์ง ๋ด์ ๋ณด์๊ณผ ๊ท์ ์ค์๋ฅผ ๋ด๋ณดํ๊ธฐ ์ํ ์ ์ฑ ๋ค์ ์๋ฆฝํ๋ ๋ณด์ ์ ๋ฌธ๊ฐ๋ค์๊ฒ๋ ๋งค์ฐ ์ค์ํ ์ญํ ์ด ์์ผ๋ฉฐ, ์ํํธ์จ์ด ๊ฐ๋ฐ์ ๋ด๋นํ๋ ํ๋ก๊ทธ๋๋จธ๋ค ์ญ์ ์ด์ ๋ชป์ง ์๊ฒ ์ค์ํ ์ญํ ์ด ์๋ค. ํ์ง๋ง, ๊ทธ ๋์ ์ญํ ์๋ ๋ถ๋ช ํ ์ฐจ์ด๊ฐ ์๋ค. ๋น์ฆ๋์ค ์ ํ๋ฆฌ์ผ์ด์ ๋ค์ ๊ธฐ์ ์๊ฒ ํต์ฌ์ ์ธ ์์ฐ์ธ ๋งํผ, ๊ธฐ์ ์ ๋ณด์์ ๋ณด์ ์ ๋ฌธ๊ฐ๋ค์ด ์๋ ์ํํธ์จ์ด ์์ง๋์ด๋ค์๊ฒ๋ง ๋งก๊ฒจ๋๋ ๊ฒ์ ๊ธ๋ฌผ์ด๋ค. ๋ฐ๋ผ์, ์ํํธ์จ์ด ํ๋ก๊ทธ๋๋จธ๋ค์ด ๋ณด์์ ์ฑ ์ ์ํํธ์จ์ด๋ก ๋ง๋๋ ๋ถ๋ด์ ๋์ด์ฃผ๊ณ ์ด ์ ๋ฌด๋ฅผ ์ ๋ขฐํ ์ ์๋ ๋ณด์ ์๋ฃจ์ ์ ๋ฌธ๊ฐ๋ค์ด ๋ด๋นํ๋๋ก ํ๋ ๊ฒ์ด ํ๋ช ํ ์ ๊ทผ๋ฒ์ด๋ผ๊ณ ํ ์ ์๋ค. ์ด๋ฐ ๊ด์ ์์ ๋ณผ ๋, ๋ณด์์ ์๋-ํฌ-์๋ ๊ณผ์ ์ด๋ฉฐ ๋๋ฐ์ด์ค, ์ก์ธ์ค, ๋คํธ์ํฌ, ์ ํ๋ฆฌ์ผ์ด์ ๋ฐ ์คํ ๋ฆฌ์ง๋ฅผ ํฌํจํด ์ฌ์ฉ์์ ๊ธฐ์ ๊ฐ์ ์ํธ์์ฉ์ด ์ด๋ฃจ์ด์ง๋ ๋ชจ๋ ๋ถ์ผ๋ฅผ ๋น ์ง ์์ด ๊ด์ฅํ๋ ์ ์ฑ ์ ํ์๋ก ํ๋ค. ์ด๋ ๊ฒ ์์ง์ด๋ ๊ฐ ๋ถ๋ถ๋ค์ ๋ณต์ก์ฑ์ผ๋ก ์ธํด, ๋๋ก๋ ๋ช ๊ฐ ์ง์ ์ ๋ณด์ ๋ฌธ์ ๋ค์ ํ๋์ ์๋ฃจ์ ์ผ๋ก ํตํฉํ๋ ๊ฒ์ด ๋ ๋ฐ๋์งํ๋ค. ๊ฐ๋จํ๊ฒ ๋งํด ์ด๊ฒ์ ์ ์ฐจ์ ๊ฐ์ํ์ ์ ์ฌํ๋ฉฐ, ๋น์ฆ๋์ค ์ธ๊ณ์์ ์ปจ์คํดํธ๋ค์ด โBPR (์ ๋ฌด ํ๋ก์ธ์ค ์ฌ์ค๊ณ โ Business Process Reengineering)โ์ด๋ผ๊ณ ๋ถ๋ฅด๋ ๊ฒ๊ณผ ํฌ๊ฒ ๋ค๋ฅด์ง ์๋ค. ๊ฐ ๊ฐ์ธ์๊ฒ๋ ์ด๊ฒ์ด ์ด๋ป๊ฒ ๋ณด์ผ์ง ๋ชฐ๋ผ๋, CFO (์ต๊ณ ์ฌ๋ฌด์ฑ ์์)์ ๊ด์ ์์๋ ์ด์๋น์ฉ ๋ฐ ํฌ์๋น์ฉ์์ ์์ฒญ๋ ์ ๊ฐํจ๊ณผ๋ฅผ ์๋ฏธํ๋ ๊ฒ์ด๋ค. ์๋ฅผ ๋ค์ด, ์ต๊ทผ ์ ํ๋ฆฌ์ผ์ด์ ๋ณด์์ ์ ํ๋ฆฌ์ผ์ด์ ๋๋ฆฌ๋ฒ๋ฆฌ ์ปจํธ๋กค๋ฌ (ADC: Application Delivery Controller) ๋ด์ ํ์ฌ๋๋ ์ถ์ธ์ด๋ค. ADC๋ ํ์์ ์ผ๋ก ์ ํ๋ฆฌ์ผ์ด์ ์ ์ต์ข ์ฌ์ฉ์์๊ฒ ์์ ํ๊ฒ ์ ๊ณตํ๊ธฐ ์ํ ๋ชฉ์ ์ผ๋ก ๊ฐ๋ฐ๋์๋ค. ์ค๋๋ , ADC๋ ํ๊ฐ๋์ง ์์ ์ ๊ทผ์ ์ฐจ๋จํ๋ ํํธ, ๊ตญ์ ์น ํ์ค๊ธฐ๊ตฌ์ธ OWASP์์ ๊ท์ ํ ๊ฒ๋ค๊ณผ ๊ฐ์ ๊ณ ๋์ ์ ํ๋ฆฌ์ผ์ด์ ๋ ๋ฒจ ๊ณต๊ฒฉ๋ค์ ๋ง์์ฃผ๋ ์ญ๋์ด ์ถ๊ฐ๋๋ฉด์ ์ผ์ข ์ ์์ ํ ์ ํ๋ฆฌ์ผ์ด์ ๋ณด์๊ด๊ณผ ๊ฐ์ ์ญํ ์ ๋ด๋นํ๋ค. ๊ทธ๋ฌ๋, ์ํฉ์ ๋์ฑ ๋ณต์กํ๊ฒ ๋ณํ๊ณ ์๋ค. CIO (์ต๊ณ ์ ๋ณด์ฑ ์์)๋ค์ ์ ๊ณ , ์ ๋ฅํ๋ฉฐ, ์๊ตฌ์ฌํญ์ด ๋ง์ Y์ธ๋ ์ง์๋ค์ ์๊ตฌ๋ฅผ ํด๊ฒฐํด์ผ ํ๋ ์ํฉ์ ์ง๋ฉดํด ์๋๋ฐ, ์ด๋ค์ ์์ ์ด ์ ํํ๋ ๋๋ฐ์ด์ค๋ฅผ ์ด์ฉํด ์ผํ๊ธฐ๋ฅผ ์ํ๊ณ , ๊ฐ์ธ์ํ๊ณผ ์ง์ฅ ๋คํธ์ํฌ ์ฌ์ด๋ฅผ ์์ ๋กญ๊ฒ ์ ํํ ์ ์๊ธฐ๋ฅผ ๋ฐ๋๋ค. CIO๋ค์ ๋์ฑ ๋ณต์กํด์ง๊ณ ์ฆ๊ฐํ๋ ์ํ๋ค๋ก๋ถํฐ ๊ธฐ์ ์ ์์ฐ์ ์ง์ผ์ผ ํ๋ ๊ณผ์ ๋ฅผ ์๊ณ ์๋ค. ๊ฒ๋ค๊ฐ, ๋น์ฉ๊ด๋ฆฌ์ ํ์ฅ์ฑ์ ์ํด ํด๋ผ์ฐ๋๋ฅผ ์ด์ฉํด์ผ ํจ์ ๋ฐ๋ผ ๋ณด์ ๋ฌธ์ ๋ ํต์ ๊ฐ ๋ถ๊ฐ๋ฅํ ์์ค์ผ๋ก ์ปค์ง๊ณ ์๋ค. ์ด๋ฌํ ์ํฉ์ผ๋ก ์ธํด, ์ฌ์ฉ์์ ํ๋์์๋ง์ด ์๋๋ผ ๊ธฐ์ ์ ํ๋ฆฌ์ผ์ด์ ๋ค์ ํ๋์์๋ ์ดํดํ๊ณ , ์ฌ์ฉ์ ๊ฒฝํ์ ์ต์ํ์ ์ํฅ์ ๋ฏธ์น๋ฉด์ ๊ธฐ์ ์ ๋ณด์ ์ ์ฑ ์ ์งํํ ์ ์๋ ํ์ ์ ์ธ ๋ณด์ ์๋ฃจ์ ๋ค์ด ์๊ตฌ๋๊ณ ์๋ค. F5๋ ๋ณด์ ์ฌ์ ์ด ์ ๋ขฐ๋ฅผ ๊ธฐ๋ฐ์ผ๋ก ํ๋ ์ฌ์ ์ด๋ผ๊ณ ๋ฏฟ๋๋ค. ์ฌ๋ฐ๋ฅธ ์ ์ฐจ์ ์ ์ฑ ์ ์๋ฆฝํ๋ ๊ฒ์ด์ผ๋ง๋ก ์ ์ฒด๋ฅผ ์ ํํ๋ ๊ฒ๋ณด๋ค ์ค์ํ ์ผ์ด๋ค. ์ ์ฑ ๊ณผ ์ ์ฐจ๊ฐ ํ์ํ ์๋ฃจ์ ์ ๊ฒฐ์ ํ๋ ๊ฒ์ด์ง ๊ทธ ๋ฐ๋๊ฐ ๋์ด์๋ ์ ๋๋ค. Original blog post by Kuna.
