Web Application Moving Target Defense

Motivation

• Web application remains the most popular way for businesses to provide services over the Internet. It is the "front door" of many companies, and therefore their security is of paramount importance.
• Example [1]
• JPMorgan Chase breach in 2014 affected 76 million US households
• Bloomberg reported that the hackers exploited an overlooed falow in one of the bank's webistes.
• The efforts in discovering and fixing vulnerabilities are not enough to protect web applications for many reasons [1]
• The increasing complexity of modern web applications brings inevitable risks that cannot be fully mitigated in the process of web application development and deployment
• Attackers can take their time, to understand the web application's functionality and technology stack, before launching an attack

Background

• Web application technology

Objective

• Ref [1]
• The key issue is to design MTD mechanism that 
• Prevent or disrupt a vulnerability or exploit
• While still providing the identical functionality

Issues

• Choose what component to move in a web application
• Decide the optimal time and how often to move components

Proposals

• Change the server-side language used in a web application 
• automatically translating server-side web application code to another language in order to prevent Code Injection exploits
• Shifts the Database used in a web application
• transform the backend SQL database into different implementations that speak different dialects in order to prevent SQL Injection exploits.

Reference

[1] Toward a Moving Target Defense for Web Applications, by Marthony Taguinod et al., in International Conference on Information Reuse and Integeration 2015