Kubernetes WAAP Version 1.15.0
This version includes the following new capabilities:
Response Tracking
The Response Tracking feature is designed to effectively monitor and manage the application’s response behavior with a focus on security and performance.
This feature is currently exclusively available for Istio and Envoy environments, providing targeted support for your web applications and APIs.
Response Tracking plays a crucial role in mitigating various types of attacks, including:
Rate Limiting Attacks—By setting custom rate limits, you can thwart rate limiting attacks where malicious actors attempt to overwhelm your application with excessive requests.
Brute Force Attacks—You can effectively block malicious actors attempting brute force attacks on your application by defining a blocking period when rate limits are exceeded.
Security Scanning—Monitor specific response codes, headers, or response flags to detect and respond to security scanning attempts for safeguarding your application's data.
Session Hijacking—A specific header injected in the server response enables you to detect unusual session behavior (controlled by the application) to prevent attempts to hijack user sessions.
Data Exfiltration—Identify and respond to abnormal response code patterns that may indicate data exfiltration attempts by malicious actors.
The following options are available in the configuration:
Rate Limit per Actor—The custom rate limits are available per Actor, allowing you to finely control the traffic flow based on the source IP, the user name, or the application ID, for example.
Blocking Period Configuration—To maintain security and ensure optimal application performance, you can define a blocking period that activates when the specified rate limit threshold is exceeded. This helps mitigate potential attacks and manage resource allocation efficiently.
Response Code Tracking—Customize your response tracking by specifying HTTP server response codes. You can monitor specific response codes or entire families, such as 4xx or 5xx, to gain visibility into potential issues or security threats.
Header Tracking—Response tracking is not limited to response codes; it can also include monitoring specific headers in the server response. This enables you to track specific data or parameters, critical to your application's functionality and security.
Many other Response Flags Tracking—Another powerful aspect of this feature is the ability to track any flag in the server response such as the response flags (description of the server response code).
Integration with Violation Rating—Response Tracking seamlessly integrates with Violation Rating, our comprehensive security assessment tool. This ensures that any response-related violations are accurately rated which allows you to prioritize and address security concerns efficiently.
Incorporating the Response Tracking feature into your application security strategy helps you to proactively manage and secure your web applications and APIs, while also mitigating a wide range of potential attacks.