Configuring Basic Protection Rules to Defend Against Common Web Attacks

Prerequisites

A protected website has been added. For details, see Adding a Website to EdgeSec.

Constraints

• Basic web protection has two modes: Block and Log only.
• It takes several minutes for a new rule to take effect. After the rule takes effect, protection events triggered by the rule will be displayed on the Events page.
• If you select Block for Basic Web Protection, you can configure access control criteria for a known attack source. EdgeSec will block requests matching the configured IP address, Cookie, or Params for a length of time configured as part of the rule.

Procedure

1. Log in to the EdgeSec console.
2. In the navigation pane on the left, choose Edge Security > Website Settings. The Website Settings page is displayed.
3. In the Policy column of the row containing the domain name, click the number to go to the Policies page.
   Figure 1 Website list
   

4. In the Basic Web Protection configuration box, ensure that the basic web protection rule is enabled.
5. On the Protection Status tab page on the right, enable protection types you need by referring to Table 1.
   Figure 2 Basic web protection
   
   1. Set the protective action.
      • Block: The detected attacks are blocked and logged.
      • Log only: The detected attacks are logged only.
      

      If you set Protective Action to Block, you can select a known attack source rule to let EdgeSec block requests accordingly. For details, see Configuring a Known Attack Source Rule.

   2. Set the protection type.

      Table 1 Protection types

      Type	Description
      General Check	Defends against attacks such as SQL injections, XSS, remote overflow vulnerabilities, file inclusions, Bash vulnerabilities, remote command execution, directory traversal, sensitive file access, and command/code injections. SQL injection attacks are mainly detected based on semantics. NOTE: If you enable General Check, EdgeSec checks your websites based on the built-in rules.
      Web Shell Detection	You can enable or disable web shell detection. If you enable Web Shell Detection, EdgeSec detects web page Trojan inserted through the upload interface.

      

      By default, General Check is enabled. You can enable other protection types by referring to Table 1.

Example - Blocking SQL Injection Attacks

If domain name www.example.com has been connected to EdgeSec, perform the following steps to verify that EdgeSec can block SQL injection attacks.

1. Enable General Check in Basic Web Protection and set the protection mode to Block.
   Figure 3 Enabling General Check
   

2. Enable EdgeSec basic web protection.
   Figure 4 Enabling EdgeSec basic web protection
   

3. Clear the browser cache and enter a simulated SQL injection (for example, http://www.example.com?id=' or 1=1) in the address box.

   The access request is blocked. Figure 5 shows an example of the block page.

   Figure 5 Block page
   

4. Go to the EdgeSec console. In the navigation pane on the left, choose Events. View the event on the Events page.