Web Application Firewall:Configure account security

Prerequisites

• You have purchased a Web Application Firewall (WAF) instance of the Pro or higher.

• Your website has been added to WAF. For more information, see Tutorials.

Background information

Before you configure account security protection, you must identify the relevant endpoints in your application. This includes the domain name, the URL where account credentials are submitted, and the parameter names for the username and password fields. Each WAF instance can protect a maximum of three endpoints.

Add a protected endpoint

1. Log on to the Web Application Firewall console.

2. In the top menu bar, select the resource group and region for your Web Application Firewall instance (Chinese Mainland or Outside Chinese Mainland).

3. In the left-side navigation pane, choose Scenario-specific Protection > Account Security.

4. On the Account Security page, click Add Endpoint.

   If this is your first time on the Account Security page, skip this step.

   Note

   Each WAF instance can protect a maximum of three endpoints. If three endpoints are already added, the Add Endpoint button is disabled.

5. In the Add Endpoint dialog box, configure the endpoint parameters, set the Protective Action to Report or Block, and then click Save. Parameters include the Endpoint to be Detected address (e.g., /login.do), Request Method, Account Parameter Name (e.g., username), and Password Parameter Name (e.g., pwd).

   Parameter	Description
   Endpoint	Select the domain that you want to protect and enter the URI of the endpoint where account credentials are submitted. The endpoint is not the address of the login page (e.g., /login.html), but the API that receives the submitted credentials. Note If you have enabled asset discovery, WAF automatically populates all endpoints for the added domain. You can select the endpoint that you want to protect from the list. For more information, see asset discovery.
   Request Method	Select the request method for the endpoint. Valid values: POST, GET, PUT, and DELETE.
   Account Parameter Name	Specify the parameter name for the account field.
   Password Parameter Name	Specify the parameter name for the password field. If the endpoint does not require a password, you can leave this parameter empty.
   Action	Select an action for requests identified as account security risks. Valid values: Alert Block

   Configuration examples:

   • Scenario 1: If the login endpoint is /login.do and the POST request body is username=Jammy&pwd=123456, set Account Parameter Name to username and Password Parameter Name to pwd.

   • Scenario 2: If the login credentials are in the URL of a GET request, such as /login.do?username=Jammy&pwd=123456, set Request Method to GET. The other settings are the same as in Scenario 1.

   • Scenario 3: If the endpoint does not require a password, such as for a user registration endpoint, you only need to specify the Account Parameter Name. You can leave Password Parameter Name empty.

   • Scenario 4: If the endpoint uses a mobile number as the user credential, treat the mobile number as the account parameter. For example, if the request is /sendsms.do?mobile=1381111****, set Endpoint to /sendsms.do and Account Parameter Name to mobile. You can leave Password Parameter Name empty.

   After you add the protected endpoint, WAF dispatches a detection task. If traffic to the endpoint matches the detection logic, account security events are generated within a few hours.

   Note

   After you enable account security, WAF checks all requests to your website against account security rules by default. You can configure a data security whitelist to allow requests that meet specific conditions to bypass these checks. For more information, see Configure a data security whitelist.

View account security reports

On the Account Security page, click View Report in the Actions column for an endpoint to view its report. Alternatively, you can view account security reports on the WAF Security Report page.

The following procedure describes how to view the account security report from the Security Report page.

1. Log on to the Web Application Firewall console.

2. In the top menu bar, select the resource group and region for your Web Application Firewall instance (Chinese Mainland or Outside Chinese Mainland).

3. In the left navigation pane, choose Security Operations > Security Reports.

4. On the Web Security tab, click Account Security. Select the domain, endpoint, and time range (Yesterday, Today, 7 Days, or 30 Days) to view the corresponding account security risk events.

   The following table describes the fields in the account security report.

   Field	Description
   Endpoint	The URI of the endpoint where account security events were detected.
   Domain Name	The domain to which the endpoint belongs.
   Time Frame of Malicious Requests	The period when account security events were detected.
   Blocked requests	The number of requests to the endpoint that were blocked by WAF protection policies during the time range specified in Time Frame of Malicious Requests. These policies include all effective protection rules, such as web attack protection rules, custom protection policy (ACL), HTTP flood protection, and the region blacklist. This count helps indicate how effectively account risk is mitigated for the endpoint.
   Total Requests	The total number of requests sent to the endpoint during the time range specified in Time Frame of Malicious Requests.
   Alert Cause	The reason the alert was triggered. Examples include: The request matches the behavioral model for a dictionary attack or brute-force attack. The traffic baseline for the endpoint was anomalous during the specified period. A large number of requests to the endpoint matched entries in the threat intelligence database during the specified period. A large number of requests to the endpoint contained a weak password during the specified period, indicating a risk of a brute-force attack or dictionary attack.

More information

The WAF account security feature is for detection only. Because account security involves complex business logic and technical scenarios, you should select a protection strategy based on your specific needs. For more information, see Account security best practices.