Dell SonicWALL Secure Mobile Access 8.5
Administration Guide
305
Example Use Cases for Rules
This section provides examples of positive and negative security models, as well as several examples showing
the use of anti-evasive measures to provide a deeper understanding of these anti-evasive techniques.
Example – Positive Security Model: Blocking Bad Logins
To prevent log in to an Application Offloaded Web site if the length of the password is less than 8 characters,
you would create a rule chain containing the following two rules:
1 Select
Host
as the
Variable
and click
+
to add it, set the
Operator
to
Equals String
, and set
Value
to
the Virtual Host name of the portal. This checks that the Host header of the login request matches the
site you are trying to protect. In this case, the rule chain is only being applied to one site.
2 Select
Parameter Value
as the
Variable
and type
password
into the selection field, then click +
to add
the variable and selected item to the rule, set the
Operator
to
<
(less than), and set
Value
to
8
. Select
String Length
in the
Anti-Evasive Measures
list to compute the length of the password form
parameter.
The action for the rule chain would be set to
Prevent
.
shows the rule chain for this example.
URL Decode
URL Decode (Unicode)
Use the
URL Decode
measure to decode URL encoded strings in the input. Use the
URL Decode (Unicode)
measure to handle
%uXXXX
encoding. URL encoding is used
to safely transmit data over the Internet when URLs contain characters outside the
ASCII character set.
NOTE
: Do not use these measures against an input that has been decoded already.
This is an anti-evasive measure to prevent hackers from using URL encoding to bypass
rules, knowing that the backend Web server can interpret their malicious input after
decoding it.
For example, the URI
www.eshop.com/hack+URL%3B
is converted to
www.eshop.com/hack URL
by this operator before the comparison is made.
Trim
Use the
Trim
measure to remove spaces before and after the input data before the
comparison. Extra spaces can cause a rule to not match the input, but are
interpreted by the backend Web application.
This is an anti-evasive measure to prevent hackers from adding spaces before and
after the input data to bypass the rule.
Table 36. Anti-Evasive Measures for Rules (Continued)
Measure
Description
