Skip to content

Partial IAST opt-out when AppSec is enabled - #6621

Merged
manuel-alvarez-alvarez merged 2 commits into
masterfrom
malvarez/iast-opt-out-appsec
Mar 1, 2024
Merged

Partial IAST opt-out when AppSec is enabled#6621
manuel-alvarez-alvarez merged 2 commits into
masterfrom
malvarez/iast-opt-out-appsec

Conversation

@manuel-alvarez-alvarez

@manuel-alvarez-alvarez manuel-alvarez-alvarez commented Feb 5, 2024 •
edited
Loading

Copy link
Copy Markdown
Member

What Does This Do

Enables certain IAST instrumentations when AppSec is enabled, the rationale is to enable all instrumentations that do not require taint tracking / call sites and provide value without any noticeable overhead.

The list of vulnerabilities that will be enabled in opt-out are:

  • HSTS header missing
  • X-Content-Type header missing
  • Insecure cookies
  • No HTTPOnly cookie
  • No SameSite cookie
  • Stack trace leak
  • Application related vulnerabilities (insecure JSP layout, default html escape invalid, admin console active, ...)

Motivation

Additional Notes

Jira ticket: APPSEC-10441

@manuel-alvarez-alvarez manuel-alvarez-alvarez added the comp: asm iast Application Security Management (IAST) label Feb 5, 2024
@manuel-alvarez-alvarez
manuel-alvarez-alvarez force-pushed the malvarez/iast-opt-out-appsec branch from 660dbe5 to a00e34b Compare February 5, 2024 20:39
@manuel-alvarez-alvarez manuel-alvarez-alvarez mentioned this pull request Feb 5, 2024
Closed
@pr-commenter

pr-commenter Bot commented Feb 5, 2024 •
edited
Loading

Copy link
Copy Markdown

Benchmarks

Startup

Parameters

Baseline Candidate
baseline_or_candidate baseline candidate
git_branch master malvarez/iast-opt-out-appsec
git_commit_date 1709286457 1709286779
git_commit_sha d41fb9c 9070f4f
release_version 1.31.0-SNAPSHOT~d41fb9c42e 1.31.0-SNAPSHOT~9070f4f58b
See matching parameters
Baseline Candidate
application insecure-bank insecure-bank
ci_job_date 1709289942 1709289942
ci_job_id 447964648 447964648
ci_pipeline_id 29277070 29277070
cpu_model Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
module Agent Agent
parent None None
variant iast iast

Summary

Found 1 performance improvements and 0 performance regressions! Performance is the same for 43 metrics, 10 unstable metrics.

scenario Δ mean execution_time candidate mean execution_time baseline mean execution_time
scenario:startup:petclinic:appsec:Remote Config better
[-40.409µs; -24.866µs] or [-6.355%; -3.911%]		 603.192µs 635.830µs
Startup time reports for petclinic 
gantt
    title petclinic - global startup overhead: candidate=1.31.0-SNAPSHOT~9070f4f58b, baseline=1.31.0-SNAPSHOT~d41fb9c42e

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.077 s) : 0, 1077069
Total [baseline] (9.137 s) : 0, 9137321
Agent [candidate] (1.086 s) : 0, 1085852
Total [candidate] (9.18 s) : 0, 9180464
section appsec
Agent [baseline] (1.176 s) : 0, 1176352
Total [baseline] (9.286 s) : 0, 9286340
Agent [candidate] (1.2 s) : 0, 1200112
Total [candidate] (9.335 s) : 0, 9335323
section iast
Agent [baseline] (1.207 s) : 0, 1207497
Total [baseline] (9.334 s) : 0, 9333640
Agent [candidate] (1.212 s) : 0, 1211625
Total [candidate] (9.371 s) : 0, 9371324
section profiling
Agent [baseline] (1.268 s) : 0, 1268008
Total [baseline] (9.316 s) : 0, 9316422
Agent [candidate] (1.286 s) : 0, 1286102
Total [candidate] (9.484 s) : 0, 9483858
Loading
  • baseline results
Module Variant Duration Δ tracing
Agent tracing 1.077 s -
Agent appsec 1.176 s 99.283 ms (9.2%)
Agent iast 1.207 s 130.428 ms (12.1%)
Agent profiling 1.268 s 190.939 ms (17.7%)
Total tracing 9.137 s -
Total appsec 9.286 s 149.018 ms (1.6%)
Total iast 9.334 s 196.319 ms (2.1%)
Total profiling 9.316 s 179.101 ms (2.0%)
  • candidate results
Module Variant Duration Δ tracing
Agent tracing 1.086 s -
Agent appsec 1.2 s 114.26 ms (10.5%)
Agent iast 1.212 s 125.774 ms (11.6%)
Agent profiling 1.286 s 200.25 ms (18.4%)
Total tracing 9.18 s -
Total appsec 9.335 s 154.859 ms (1.7%)
Total iast 9.371 s 190.86 ms (2.1%)
Total profiling 9.484 s 303.394 ms (3.3%) 
gantt
    title petclinic - break down per module: candidate=1.31.0-SNAPSHOT~9070f4f58b, baseline=1.31.0-SNAPSHOT~d41fb9c42e

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (686.355 ms) : 0, 686355
BytebuddyAgent [candidate] (699.062 ms) : 0, 699062
GlobalTracer [baseline] (296.442 ms) : 0, 296442
GlobalTracer [candidate] (292.175 ms) : 0, 292175
AppSec [baseline] (51.428 ms) : 0, 51428
AppSec [candidate] (51.743 ms) : 0, 51743
Remote Config [baseline] (722.047 µs) : 0, 722
Remote Config [candidate] (728.123 µs) : 0, 728
Telemetry [baseline] (7.846 ms) : 0, 7846
Telemetry [candidate] (7.79 ms) : 0, 7790
section appsec
BytebuddyAgent [baseline] (686.281 ms) : 0, 686281
BytebuddyAgent [candidate] (697.111 ms) : 0, 697111
GlobalTracer [baseline] (296.711 ms) : 0, 296711
GlobalTracer [candidate] (292.222 ms) : 0, 292222
AppSec [baseline] (151.439 ms) : 0, 151439
AppSec [candidate] (151.15 ms) : 0, 151150
Remote Config [baseline] (635.83 µs) : 0, 636
Remote Config [candidate] (603.192 µs) : 0, 603
Telemetry [baseline] (6.942 ms) : 0, 6942
Telemetry [candidate] (6.862 ms) : 0, 6862
IAST [candidate] (17.786 ms) : 0, 17786
section iast
BytebuddyAgent [baseline] (801.041 ms) : 0, 801041
BytebuddyAgent [candidate] (803.175 ms) : 0, 803175
GlobalTracer [baseline] (288.581 ms) : 0, 288581
GlobalTracer [candidate] (290.028 ms) : 0, 290028
AppSec [baseline] (50.919 ms) : 0, 50919
AppSec [candidate] (50.254 ms) : 0, 50254
Remote Config [baseline] (601.099 µs) : 0, 601
Remote Config [candidate] (588.821 µs) : 0, 589
Telemetry [baseline] (6.731 ms) : 0, 6731
Telemetry [candidate] (7.483 ms) : 0, 7483
IAST [baseline] (25.25 ms) : 0, 25250
IAST [candidate] (25.656 ms) : 0, 25656
section profiling
BytebuddyAgent [baseline] (676.798 ms) : 0, 676798
BytebuddyAgent [candidate] (694.859 ms) : 0, 694859
GlobalTracer [baseline] (379.001 ms) : 0, 379001
GlobalTracer [candidate] (378.042 ms) : 0, 378042
AppSec [baseline] (52.915 ms) : 0, 52915
AppSec [candidate] (53.428 ms) : 0, 53428
Remote Config [baseline] (753.497 µs) : 0, 753
Remote Config [candidate] (800.153 µs) : 0, 800
Telemetry [baseline] (9.018 ms) : 0, 9018
Telemetry [candidate] (7.485 ms) : 0, 7485
ProfilingAgent [baseline] (93.619 ms) : 0, 93619
ProfilingAgent [candidate] (95.091 ms) : 0, 95091
Profiling [baseline] (93.643 ms) : 0, 93643
Profiling [candidate] (95.115 ms) : 0, 95115
Loading

Load

Request duration reports for petclinic 
gantt
    title petclinic - request duration [CI 0.99] : candidate=1.31.0-SNAPSHOT~9070f4f58b, baseline=1.31.0-SNAPSHOT~d41fb9c42e
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.372 ms) : 1353, 1391
.   : milestone, 1372,
appsec (1.761 ms) : 1738, 1785
.   : milestone, 1761,
iast (1.519 ms) : 1496, 1542
.   : milestone, 1519,
profiling (1.539 ms) : 1515, 1562
.   : milestone, 1539,
tracing (1.534 ms) : 1510, 1557
.   : milestone, 1534,
section candidate
no_agent (1.36 ms) : 1341, 1379
.   : milestone, 1360,
appsec (1.78 ms) : 1757, 1804
.   : milestone, 1780,
iast (1.551 ms) : 1529, 1574
.   : milestone, 1551,
profiling (1.554 ms) : 1529, 1580
.   : milestone, 1554,
tracing (1.503 ms) : 1479, 1527
.   : milestone, 1503,
Loading
  • baseline results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 1.372 ms [1.353 ms, 1.391 ms] -
appsec 1.761 ms [1.738 ms, 1.785 ms] 389.206 µs (28.4%)
iast 1.519 ms [1.496 ms, 1.542 ms] 146.584 µs (10.7%)
profiling 1.539 ms [1.515 ms, 1.562 ms] 166.696 µs (12.1%)
tracing 1.534 ms [1.51 ms, 1.557 ms] 161.501 µs (11.8%)
  • candidate results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 1.36 ms [1.341 ms, 1.379 ms] -
appsec 1.78 ms [1.757 ms, 1.804 ms] 420.021 µs (30.9%)
iast 1.551 ms [1.529 ms, 1.574 ms] 191.359 µs (14.1%)
profiling 1.554 ms [1.529 ms, 1.58 ms] 194.372 µs (14.3%)
tracing 1.503 ms [1.479 ms, 1.527 ms] 143.062 µs (10.5%)
Request duration reports for insecure-bank 
gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.31.0-SNAPSHOT~9070f4f58b, baseline=1.31.0-SNAPSHOT~d41fb9c42e
    dateFormat X
    axisFormat %s
section baseline
no_agent (368.016 µs) : 348, 388
.   : milestone, 368,
iast (475.669 µs) : 455, 496
.   : milestone, 476,
iast_FULL (541.717 µs) : 521, 562
.   : milestone, 542,
iast_GLOBAL (504.745 µs) : 483, 526
.   : milestone, 505,
iast_HARDCODED_SECRET_DISABLED (473.189 µs) : 453, 493
.   : milestone, 473,
iast_INACTIVE (457.544 µs) : 437, 478
.   : milestone, 458,
iast_TELEMETRY_OFF (471.517 µs) : 451, 492
.   : milestone, 472,
tracing (445.883 µs) : 425, 467
.   : milestone, 446,
section candidate
no_agent (367.603 µs) : 348, 387
.   : milestone, 368,
iast (477.187 µs) : 457, 498
.   : milestone, 477,
iast_FULL (544.944 µs) : 524, 565
.   : milestone, 545,
iast_GLOBAL (494.482 µs) : 474, 515
.   : milestone, 494,
iast_HARDCODED_SECRET_DISABLED (471.008 µs) : 451, 491
.   : milestone, 471,
iast_INACTIVE (456.398 µs) : 434, 479
.   : milestone, 456,
iast_TELEMETRY_OFF (479.397 µs) : 459, 500
.   : milestone, 479,
tracing (451.095 µs) : 431, 471
.   : milestone, 451,
Loading
  • baseline results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 368.016 µs [348.197 µs, 387.835 µs] -
iast 475.669 µs [455.248 µs, 496.09 µs] 107.653 µs (29.3%)
iast_FULL 541.717 µs [521.219 µs, 562.216 µs] 173.701 µs (47.2%)
iast_GLOBAL 504.745 µs [482.993 µs, 526.498 µs] 136.729 µs (37.2%)
iast_HARDCODED_SECRET_DISABLED 473.189 µs [453.105 µs, 493.273 µs] 105.173 µs (28.6%)
iast_INACTIVE 457.544 µs [436.647 µs, 478.44 µs] 89.528 µs (24.3%)
iast_TELEMETRY_OFF 471.517 µs [451.153 µs, 491.881 µs] 103.501 µs (28.1%)
tracing 445.883 µs [425.266 µs, 466.501 µs] 77.867 µs (21.2%)
  • candidate results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 367.603 µs [347.975 µs, 387.231 µs] -
iast 477.187 µs [456.521 µs, 497.852 µs] 109.584 µs (29.8%)
iast_FULL 544.944 µs [524.484 µs, 565.404 µs] 177.341 µs (48.2%)
iast_GLOBAL 494.482 µs [474.314 µs, 514.651 µs] 126.879 µs (34.5%)
iast_HARDCODED_SECRET_DISABLED 471.008 µs [450.707 µs, 491.308 µs] 103.405 µs (28.1%)
iast_INACTIVE 456.398 µs [434.243 µs, 478.553 µs] 88.795 µs (24.2%)
iast_TELEMETRY_OFF 479.397 µs [458.838 µs, 499.957 µs] 111.794 µs (30.4%)
tracing 451.095 µs [430.984 µs, 471.206 µs] 83.492 µs (22.7%)

jandro996
jandro996 reviewed Feb 6, 2024
View reviewed changes
Comment thread benchmark/startup/petclinic/benchmark.json Outdated
@manuel-alvarez-alvarez
manuel-alvarez-alvarez force-pushed the malvarez/iast-opt-out-appsec branch from a00e34b to 393ddd3 Compare February 6, 2024 11:00
@manuel-alvarez-alvarez
manuel-alvarez-alvarez marked this pull request as ready for review February 6, 2024 12:44
@manuel-alvarez-alvarez
manuel-alvarez-alvarez force-pushed the malvarez/iast-opt-out-appsec branch from 3b0905b to 3c785f2 Compare February 6, 2024 13:23
@manuel-alvarez-alvarez
manuel-alvarez-alvarez changed the base branch from master to malvarez/iast-application-vul-telemetry February 6, 2024 13:24
@smola smola changed the title Initial version of IAST opt-out with AppSec enabled Partial IAST opt-out when AppSec is enabled Feb 6, 2024
Base automatically changed from malvarez/iast-application-vul-telemetry to master February 7, 2024 08:28
@manuel-alvarez-alvarez
manuel-alvarez-alvarez force-pushed the malvarez/iast-opt-out-appsec branch 2 times, most recently from 64d04f9 to 9949052 Compare February 7, 2024 17:14
ygree
ygree approved these changes Feb 12, 2024
View reviewed changes

@ygree ygree left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@manuel-alvarez-alvarez
manuel-alvarez-alvarez force-pushed the malvarez/iast-opt-out-appsec branch 3 times, most recently from ddc70a9 to d7fcd58 Compare February 16, 2024 11:56
@manuel-alvarez-alvarez
manuel-alvarez-alvarez force-pushed the malvarez/iast-opt-out-appsec branch 2 times, most recently from cc4f895 to 9f85a07 Compare February 29, 2024 08:19
@manuel-alvarez-alvarez
manuel-alvarez-alvarez force-pushed the malvarez/iast-opt-out-appsec branch from 2111fc6 to 9070f4f Compare March 1, 2024 09:53
@manuel-alvarez-alvarez
manuel-alvarez-alvarez merged commit 88f4eaf into master Mar 1, 2024
@manuel-alvarez-alvarez
manuel-alvarez-alvarez deleted the malvarez/iast-opt-out-appsec branch March 1, 2024 12:07
@github-actions github-actions Bot added this to the 1.31.0 milestone Mar 1, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dougqh dougqh dougqh approved these changes
@ygree ygree ygree approved these changes
@jandro996 jandro996 jandro996 approved these changes
@smola smola Awaiting requested review from smola

Assignees

No one assigned

Labels

comp: asm iast Application Security Management (IAST)

Projects

None yet

Milestone

1.31.0

Development

Successfully merging this pull request may close these issues.

5 participants

@manuel-alvarez-alvarez @smola @dougqh @ygree @jandro996