GB/T 32917-2016Information security technology -- Security technique requirements and testing and evaluation approaches for WEB application firewall (English PDF)

3.1 Terms and definitions

The terms and definitions as defined in GB/T 25069-2010 as well as the following terms and definitions apply to this document.

3.1.1

WEB application firewall

It is an information security product that performs protocol and content filtering on all WEB server access requests to WEB servers and WEB server responses based on pre-defined filtering rules and security protection rules, thereby realizing security protection functions for WEB servers and WEB applications.

3.1.2

WEB server

A Web server is a program that provides services to clients (such as browsers) that make requests. When a web browser (client) connects to the server and requests resources, the server will process the request and send the resources to the browser. The web server uses HTTP to communicate with the web browser. Commonly used web servers are Apache and Internet information server.

3.2 Abbreviations

The following abbreviations apply to this document.

CSRF. Cross-site Request Forgery

HTTP. Hypertext Transfer Protocol

HTTPS. Hypertext Transfer Protocol over Secure Socket Layer

SSL. Secure Socket Layer

SQL. Structured Query Language

URL. Uniform Resource Locator

WEB. World Wide Web

XSS Cross Site Scripting

4.1 Basic level

4.1.1 Security function requirements

4.1.1.1 HTTP filtering function

4.1.1.3 Other functions

4.1.1.3.1 Custom error page function

It shall be possible to customize the error page returned by the WEB server.

4.1.2 Self-security protection

4.1.2.1 Identification and authentication

4.1.2.2 Security audit

4.1.2.2.1 Audit data generation

The following audit logs shall be generated.

4.1.2.2.2 Audit log management function

Management functions such as backup and query of audit data shall be provided.

4.1.2.2.3 Comprehensible format

All audit records can be understood.

4.1.2.2.4 Prevention of loss of audit data

Log information shall be stored in a permanent storage medium. When the storage space is exhausted, corresponding measures shall be taken to ensure that the audit data is not lost.

4.1.2.3 Statistics function

It shall have the following statistical functions.

4.1.2.4 Remote management encryption

When remote management is required, the remote management communication shall be encrypted and protected.

4.1.2.5 Condition monitoring

During startup and normal work, self-checks shall be performed periodically or in accordance with the requirements of authorized administrators, including hardware working status monitoring, software module status monitoring, etc.;

when abnormal working status is detected, the administrator shall be alerted.

4.1.2.6 Dual-system hot backup

It shall have the dual-system hot backup function. When the main WEB application firewall fails, the standby WEB application firewall shall discover and take over the main WEB application firewall in time.

4.1.3 Security assurance requirements

4.1.3.1 Development

4.1.3.1.1 Security architecture

The developer shall provide a description of the security architecture of the product's security functions; the security architecture’s description shall meet the following requirements.

4.1.3.1.2 Functional specification

The developer shall provide a complete functional specification; the functional specification shall meet the following requirements.

4.1.3.1.3 Product design

Developers shall provide product design documents; the product design documents shall meet the following requirements.

4.1.3.2 Guiding documents

4.2 Enhanced level

4.2.1 Security function requirements

4.2.1.1 HTTP filtering function

4.2.1.1.1 Allowed/forbidden HTTP request types

It shall be able to set filter rules according to HTTP request types (including at least. GET, POST, PUT, HEAD, OPTIONS, etc.); allow or prohibit access according to the filter rules.

4.2.3 Security assurance requirements

4.2.3.1 Development

5.1 Test environment

Figure 1 is a schematic diagram of the functional test environment of the WEB application firewall.

5.2 Basic level

5.2.1 Evaluation method for security function requirements test

5.2.1.1 HTTP filtering function

5.2.1.1.2 Length limits of each field in the HTTP protocol header

The test evaluation method and results of the length limit of each field of the

HTTP protocol header are as follows.

5.2.1.1.4 Support multiple HTTP request parameter encoding methods

The test evaluation methods and results that support multiple HTTP request parameter encoding methods are as follows.

5.2.1.1.5 Identify and restrict HTTP response codes

The test evaluation methods and results for identifying and restricting HTTP response codes are as follows.

5.2.1.1.6 URL content keyword filtering

The test evaluation methods and results of URL content keyword filtering are as follows.

a) Test evaluation method.

The management host configures filtering rules based on URL content keywords; initiates an HTTP request containing the keywords from the test terminal, to detect whether it can block the HTTP request according to the filtering rules.

b) Test evaluation results.

Record the test results and make a judgment on whether the results fully meet the corresponding security technical requirements.

5.2.1.1.7 WEB server return content filtering

The test evaluation methods and results of the content filtering returned by the

WEB server are as follows.

5.3 Enhanced level

5.3.1 Test evaluation method of security function requirements

5.3.1.1 HTTP filtering function

5.3.3.3.2 Configuration management scope

The test evaluation methods and results of the configuration management scope are as follows.

5.3.3.3.3 Delivery procedures

The test evaluation methods and results of the delivery process are as follows.

5.3.3.3.4 Development security

The development of secured testing and evaluation methods and results are as follows.

5.3.3.3.5 Life cycle definition

The test evaluation methods and results of the life cycle definition are as follows.

5.3.3.3.6 Tools and technology

The testing and evaluation methods and results of tools and technologies are as follows.

5.3.3.4 Test

5.3.3.4.1 Coverage

The coverage test evaluation methods and results are as follows.

5.3.3.4.2 Depth

The in-depth test evaluation methods and results are as follows.

a) Test evaluation method.

The evaluator shall check whether the developer provides the following test depth evidence; check whether the information provided by the developer meets all the requirements for the content and form of the evidence.

5.3.3.4.3 Function test

The test evaluation methods and results of the functional test are as follows.

5.4 Performance test evaluation method

5.4.1 HTTP throughput

The test evaluation methods and results of HTTP throughput are as follows.

5.4.2 HTTP maximum request rate

The test evaluation method and results of HTTP maximum request rate are as follows.

......