Web Application Security Issues & Solution using UML

-

I was once involved in reviewing our company’s application architecture to identify security risks and recommend possible mitigation solutions.

Since every organisation has its own unique constraints, available resources, and risk appetite, the solution herein might not apply to other organisations.

Nevertheless, this post showcases what one can do with UML to document and explain (pictorially) security flaws in application architecture.

The as-is architecture follows.

Current eBao Deployment

A detailed explanation follows:

  • The system (under design) is a Java Enterprise Application that is deployed in AppSvr (Application Server) within the Internal zone.
  • The deployed application consists of both HTML-based as well as SOAP-based services.
  • The 2 WebSvr’s ([Apache] Web Server) in the DMZ act as proxies.
  • There is a load-balancing appliance used to balance requests to the web servers. A request pool has been created on the appliance (WebPool).
  • The (public) user would access the URL endpoint of the appliance for every request.
  • Similarly, other applications (Others) deployed on both the WebSvr and AppSvr would access the SOAP web services through the load balancer.
  • Note that the public.softwarehard.sg is a public URL that is used by both the (public) user as well as other applications (SOAP-based services).

The security issue in this architecture is that the SOAP-based services are exposed to the public. What is worse is that these services are not secured by any form of authentication.

Having reviewed the existing architecture, the available resources and constraints, I proposed a solution that suited our risk appetite and incurred minimum changes to all applications.

Proposed eBao Deployment

With the use of another load balancing appliance (which we happened to have), we created another endpoint to access the SOAP web services.

This solution allowed us to

  • mitigate the security risk
  • minimise changes to all applications
  • capitalise on the load-balancing appliances

Comments

Post a Comment

Popular posts from this blog

Understanding ITIL Service Management the UML way…

-
Image
I originally had a great deal of difficult reconciling the differences amongst ITIL Change Management, Incident Management, and Problem Management. Having researched on the subjects and understanding them better now, I’ve tried to put the concepts together using a UML class diagram to capture my understanding and to keep it imprinted. Similarly, I wanted to differentiate the various categories of changes (Standard, Emergency, Normal) using an easy to understand & self-explanatory manner – a UML Activity Diagram!
Read more

How to depict (Professional-Looking) Logical Network Diagrams in Astah

-
Image
I have always had to create (professional-looking) UML diagrams using Visio-like icons. You’ve got to admit that showing a bunch of boring UML boxes hardly interests anyone less technical (like anyone whose designation has the words “manager” or “director”). This is actually possible in Astah! I’ve created a template for future projects that allows me to produce logical network diagrams that look like the following: To create this diagram, you need to do the following: Assign various icons to stereotypes. I created the following for my use: Create a new UML Deployment Diagram Every element in the diagram is created as a Node The nodes are subsequently assigned the appropriate <<stereotype>>. E.g. Internet is <<internet>>, WebZone FW is <<firewall>>, Web LB is <<loadBalancer>> Ensure the “Icon Notation” is set to “Customized Icon” for each node Instead of the boring boxes, the corresponding icons automatically gets displayed!
Read more