Basic Web Protection

Prerequisites

You have added domain names to the Domains module in the Content Delivery Network (CDN) service. For details, see Domain Name Management.

Application Scenarios

Use EdgeSec to enable web protection for domain names.

Adding a Website to EdgeSec

1. Log in to the management console.
2. Click in the upper left corner of the page and choose Content Delivery & Edge Computing > CDN and Security.
3. In the navigation pane on the left, choose Edge Security > Website Settings. The Website Settings page is displayed.
4. In the upper left corner of the list, click Add Website. For details about the parameters, see Table 1.
   Figure 1 Adding a website
   

   Table 1 Parameters for adding a protected website

   Parameter	Description
   Website Name	Name of the website you want to protect. It must meet the following requirements: The name must be unique. The name must start with a letter. The length cannot exceed 128 characters. The value can contain uppercase letters, lowercase letters, digits, and special characters (-_:).
   Domain Name	Select a domain name to be protected. You can only select a domain name whose Service Type is Website on the Domains page of CDN.
   Website Remarks	A brief description of the website
   Policy	The System-generated policy is selected by default. You can select a policy you configured before.

5. Click OK.

Configuring a Protection Policy

1. In the navigation pane on the left, choose Edge Security > Website Settings. The Website Settings page is displayed.
2. In the Policy column of the row containing the domain name, click the number to go to the Policies page.
   Figure 2 Website list
   

3. In the Basic Web Protection configuration area, change Status and Mode as needed by referring to Table 2.
   Figure 3 Basic Web Protection configuration area
   

   Table 2 Parameter description

   Parameter	Description
   Status	Status of Basic Web Protection : enabled. : disabled.

4. In the Basic Web Protection configuration area, click Advanced Settings.
5. On the Protection Status tab page, enable protection types you need by referring to Table 4.
   Figure 4 Basic web protection
   
   

   If you select Mode for Block on the Protection Status tab, you can select a known attack source rule to let EdgeSec block requests accordingly. For details, see Configuring a Known Attack Source Rule.

   1. Set the protection level.

      In the upper right part of the page, set Protection Level to Low, Medium, or High. The default value is Medium.

      Table 3 Protection levels

      Protection Level	Description
      Low	EdgeSec only blocks the requests with obvious attack signatures. If a large number of false alarms are reported, Low is recommended.
      Medium	The default level is Medium, which meets a majority of web protection requirements.
      High	At this level, EdgeSec provides the finest granular protection and can intercept attacks with complex bypass features, such as Jolokia cyber attacks, common gateway interface (CGI) vulnerability detection, and Druid SQL injection attacks. Configure global whitelist rules after the service has been running for a period of time, and then enable the strict mode.

   2. Set the protection type.
      

      By default, General Check is enabled. You can enable other protection types by referring to Table 4.

   Table 4 Protection types

   Type	Description
   General Check	Defends against attacks such as SQL injections, XSS, remote overflow vulnerabilities, file inclusions, Bash vulnerabilities, remote command execution, directory traversal, sensitive file access, and command/code injections. SQL injection attacks are mainly detected based on semantics. NOTE: If you enable General Check, EdgeSec checks your websites based on the built-in rules.
   Webshell Detection	Protects against web shells from upload interface. NOTE: If you enable Webshell Detection, EdgeSec detects web page Trojan horses inserted through the upload interface.

Suggestions

• If you are not familiar with your website's traffic pattern, select the Log only mode for one to two weeks and analyze the logs for those days.
  • If no record of blocking legitimate requests is found, switch to the Block mode.
  • If legitimate requests are blocked, adjust the protection level or configure global protection whitelist (formerly false alarm masking) rules to prevent legitimate requests from being blocked.
• Note the following points in your operations:
  • Do not transfer the original SQL statement or JAVA SCRIPT code in a legitimate HTTP request.
  • Do not use special keywords (such as UPDATE and SET) in a legitimate URL. For example, https://www.example.com/abc/update/mod.php?set=1.
  • Use Object Storage Service (OBS) or other secure methods to upload files that exceed 50 MB rather than via a web browser.

Protection Effect

To check whether basic web protection takes effect, enter a test domain name in the address bar of your browser and simulate an SQL injection attack. If Edge WAF blocks the attack, the configuration works. You can view attack event logs on the Dashboard page.

Figure 5 Blocking SQL attacks

Figure 6 Web security event statistics

You can also view protection logs generated in yesterday, today, past 3 days, past 7 days, 30 days, or user-defined time range on the Events page. Click Details to view event details.

Figure 7 Events