How Are Broken Authentication Attacks Prevented; How Are Insecure Storage And Communications Prevented; How Is Access To Restricted Urls Prevented; How Are Slowloris Attacks Prevented - Dell SonicWall SRA 4200 Administrator's Manual

How are Broken Authentication Attacks Prevented?

The requirement for Broken Authentication and Session Management requires Web Application
Firewall to support strong session management to enhance the authorization requirements for
Web sites. Dell SonicWALL SRA already has strong authentication capabilities with the ability
to support One Time Password, Two-factor Authentication, Single Sign-On, and client
certificate authentication.
For Session Management, Web Application Firewall pops up a session logout dialog box when
the user portal is launched or when a user logs into an application offloaded portal. This feature
is enabled by default when Web Application Firewall is licensed and can be disabled from the
Web Application Firewall > Settings page.

How are Insecure Storage and Communications Prevented?

Insecure Cryptographic Storage and Insecure Communications are prevented by encrypting
keys and passwords wherever necessary, and by using SSL encryption to encrypt data
between the Web Application Firewall and the client. Dell SonicWALL SRA also supports
HTTPS with the backend Web server.

How is Access to Restricted URLs Prevented?

Dell SonicWALL SRA supports access policies based on host, subnet, protocol, URL path, and
port to allow or deny access to Web sites. These policies can be configured globally or for users
and groups.

How are Slowloris Attacks Prevented?

Slowloris attacks can be prevented if there is an upstream device, such as a Dell SonicWALL
SRA security appliance, that limits, buffers, or proxies HTTP requests. Web Application Firewall
uses a rate-limiter to thwart Slowloris HTTP Denial of Service attacks.

What Type of PCI Compliance Reports Are Available?

Payment Card Industry Data Security Standard (PCI DSS) 6.5 (Version 2.0) and PCI DSS 6.6
(Version 1.2) are covered in PCI reporting. The administrator can configure Web Application
Firewall to satisfy these PCI requirements.
You can generate and download the PCI report file on the Web Application Firewall > Status
page.
Note This is not an official PCI Compliance report. It is for your self-assessment only.
In the report cover, the following information is displayed:
•
•
•
The model, serial number, and firmware version of the appliance
The user name of the person who downloaded the report, displayed as the author of the
report
Time when the report was generated
SRA Overview | 67