# BlackWatch: Increasing Attack Awareness within Web Applications
## 2 Background
### Current Industry Methods  
Within industry a variety of methods and tools are recommended for detecting and preventing attacks against web applications. The Payment Card Industry Data Security Standards suggests two alternative solutions, one of which must be implemented to ensure compliance regulations are met [9]:  
* Regular source code and component reviews
* Detection and prevention of web-based attacks via the use of an automated solution, i.e., a web application firewall  
Due to the extensive resources required for source code and component reviews, most organizations choose to implement a web application firewall (WAF) instead. WAF solutions can effectively protect web applications from many attacks; however, to ensure effectiveness, organizations must invest a large quantity of resources into configuring and maintaining the solution. High-Tech Bridge [10] identify the issue by stating _\"ModSecurity is a very powerful and flexible WAF; however, it requires a lot of time and effort to avoid false negatives and prevent false positives\"_. While High-Tech Bridge [10] are very positive about the usage of WAFs, not all security researchers express the same opinion. [PERSON] published an article exploring the five main downfalls facing WAFs [11]:  
* _\"Negligent deployment, lack of skills and different risk mitigation priorities\"--_There is often a lack of accountability within organizations as to the entity responsible for maintaining the WAF.
* _\"Deployment only for compliance purposes\"--_Due to the PCI-DSS compliance regulations, WAF solutions are often deployed without ever being properly configured or managed.
* _\"Complicated diversity of constantly evolving web applications\"--_Web applications are constantly evolving and implementing new features, therefore keeping WAF rules up-to-date can be a challenging and time-consuming task.
* _\"Business priorities domination over cyber security\"--_A key concern of any security solution is the risk of affecting legitimate application usage. To prevent false positives from affecting user, organizations switch WAFs to 'detect only' mode. This means no preventative action is taken. Further to this, many WAFs feature poor reporting capabilities: unless an employee is tasked with manually checking the reported incidents, these attacks often go unnoticed.
* _\"Inability to protect against advanced web attacks\"--_WAFs often work by blocking known attacks and identifying events that are predetermined as malicious; therefore new, advanced attacks will not be detected.  
It is apparent that the most common downfall of WAF solutions is that often they are not configured properly, and default configurations are not effective. Security researcher [PERSON] [12] published work into WAFs where he demonstrated why default configurations are not effective. The approach of 'blacklisting' that many WAFs use consists of defining a set of data that represents known-bad attacks [13]. The issue with this type of approach as demonstrated by [PERSON] [12] is that this approach to security can be easily bypassed. Within this research, eight well renowned solutionswere tested using their default configurations, and by using a variety of different methods [PERSON] managed to bypass all eight solutions.