Securing modern-day production systems is complex and requires a variety of measures—from secure coding practices and security testing to web application firewall (WAF) protection, threat detection, and vulnerability scanning. When securing distributed, cloud-hosted applications with ephemeral hosts, traditional solutions for these measures can be painful to deploy and maintain, prone to false positives, and unable to provide zero-day coverage. Datadog Application Security Management helps DevOps and security teams centralize and streamline application security. ASM leverages Datadog’s distributed tracing to provide security coverage below the network level and with rich application context. By using ASM, security engineers and other analysts can track suspicious requests, visualize the full scope of attacks, and see which parts of the code are being targeted.
Datadog ASM now includes a slate of Protection capabilities that empower teams to take direct action against attackers. These capabilities are generally available for all ASM customers, and enable you to automatically block attacks, supplementing ASM’s vulnerability management and threat detection. In this post, we’ll show you how to use ASM to:
- Block attackers to thwart or limit the scope of a breach
- Get code-level context about an attack to avoid false-positive blocking
- Block attack attempts with the In-App WAF
Block attackers to thwart or limit the scope of a breach
ASM’s Security Signals provide detailed, actionable data about ongoing attacks against your application. ASM generates these signals automatically by evaluating your application’s behavior against the platform’s built-in detection rules, which use known patterns of attacker behavior alongside distributed traces and error logs to identify malicious activity in your environment with high accuracy. The combination of security context with distributed trace data—such as the attack type, the flow of affected services, and user metadata (ID, location, etc.)—allows you to accurately track the origin IP addresses and user IDs of authenticated attackers sending suspicious requests.
ASM’s Protection capabilities now enable you to automatically block any and all attackers associated with a signal directly within the Datadog UI—either by IP or compromised account. This IP blocking can be set indefinitely or for a custom time span, helping you slow down attackers so your team members have time to investigate and remediate any vulnerabilities. It can also help limit the scope of an attempted breach before the impact becomes more widespread.
For example, let’s say your application is targeted by a SQL injection attack. In the screenshot below, we see a Security Signal indicating that multiple SQL injection attempts have triggered a high volume of errors.
From the signal sidepanel, we can observe all 10 IP addresses where the malicious requests originated from. The “Block All Attacker IPs” button enables you to permanently block or snooze access for any or all of these IP addresses—automatically and at scale. With the attackers’ access to your application revoked, your team now has time to limit the attack’s spread and determine what remediating actions to take. More importantly, to scale your security responses and respond to threats immediately, you can configure automated attacker blocking via Detection Rules.
Get code-level context to avoid false-positive blocking
ASM helps you better understand an attack and its scope by enabling you to drill into detailed traces for each of the requests associated with its triggered security signal. ASM traces visualize the full attack flow to show how malicious requests are propagating across services. This added context helps incident responders confidently block attackers. Following the SQL injection attack in our previous example, we can drill into traces for the suspected attackers’ requests to investigate the threat.
As we can see in the screenshot above, the traces surface key information such as the user attribution, request headers, and related logs. Investigators can use them to quickly determine whether malicious users were authenticated, view the content of the users’ requests, and understand how the application responded. By providing highly granular, actionable insights along with the ability to block the malicious actors, ASM enables you to quickly secure your application with high accuracy and confidence—without accidentally blocking legitimate users.
Of course, you may discover that what appears to be attackers searching for new exploits in your application is in fact a legitimate user making malformed or unintentional requests. The ASM Denylist page provides an easy way to manage all currently blocked IP addresses and authenticated attackers from a consolidated view. The Denylist provides an overview of each blocked IP’s request history, providing the option to immediately unblock a user you’ve determined to be benign—or extend the blocking period for a confirmed attacker.
With the ability to quickly identify suspicious requests, drill into traces and other code-level insights to investigate, and revoke the requesters’ access on demand, ASM enables your teams to stop attackers from accessing your application before they’re able to exploit a critical vulnerability.
Block attack attempts with the In-App WAF
Traditional web application firewalls (WAFs) struggle in modern production environments, where complex, distributed infrastructure scales frequently with rapidly shifting network perimeters. In these environments, simply blocking attacks at the network level with no application-level context can be error-prone, and fails to provide zero-day coverage.
ASM’s In-App WAF provides a scalable and configurable way to automatically block attacks. It combines the perimeter WAF technique, which detects threats by using pattern-matching on HTTP requests, with rich application context—automatically blocking attacks while limiting false positives. The In-App WAF leverages hundreds of out-of-the-box rules to detect attack attempts, and applies an appropriate response action (monitor or block) for any requests flagged by these rules as suspicious. Because ASM is aware of an application’s routes, this protection can be applied to specific services as well as across all services.
You can configure the In-App WAF by defining policies for groups of services. Each policy can be configured with rulesets designed to thwart common attacks, including command injection, server-side request forgery, PHP code injection, cross-site scripting, and many more. Each of the rules in these sets can be configured with a rule mode (monitoring, blocking, or disabled) so you can control the automated actions taken by the WAF when a rule is triggered. In the following example, we have a policy that contains sixteen rulesets made up of over 100 blocking rules and 38 monitors.
Move beyond detection to fight threats
ASM’s Protection capabilities empower your teams to not only detect and triage threats but also to take immediate action against attackers. It provides a high degree of confidence to ensure that you’re only blocking legitimate attackers, reducing the risk that you might damage customer relationships or lose revenue by blocking legitimate users.
ASM’s Protection capabilities are now generally available for all ASM customers at no additional cost. For more information about ASM, see our documentation, or request a personalized demo to see the protection capabilities in action. If you’re brand new to Datadog, sign up for a 14-day free trial to get started.
