Security profiles
Security profile is the main Smart Web Security component. A security profile consists of a set of HTTP traffic processing rules. The rules contain filtering conditions and actions that apply to your web resource's incoming traffic. Security profiles also allow configuring a CAPTCHA and request limits based on various conditions. To standardize client response pages for triggered profile rules, you can create your own response templates.
Note
To enhance your security, we use HTTP request data to train our machine learning (ML) models. You can disable the use of this data in the management console when creating a security profile or later in its settings.
You can create security profiles in different ways:
-
From a preset template.
A preset profile includes:
- Basic default rule enabled for all traffic with the
Allowaction type. - Smart Protection rule,
sp-rule-1, enabled for all traffic with theAPI protectionaction type.
- Basic default rule enabled for all traffic with the
-
From scratch. This profile includes only the basic default rule enabled for all traffic.
You configure the security profile according to your threat model, i.e., description of your service-specific potential risks, attack actors, and vulnerabilities. If you are setting up your protection without professional cybersecurity assistance, we recommend using the preconfigured profile template set up by Yandex Cloud experts. This will insure the basic level of protection and help reduce the probability of configuration errors.
Connect a security profile to your resource to enable Smart Web Security protection.
You can connect a security profile to various types of resources:
- Virtual host or ingress controller to protect resources that use Yandex Application Load Balancer.
- API Gateway API gateway to protect the APIs of your applications.
- Domain to protect your website or web application hosted in Yandex Cloud, your internal infrastructure, or other platforms.
Protection modes
The protection mode decides which profile rules will apply to traffic and how strict Smart Protection will be. These modes allow you to pre-configure additional rules and activate them during a load surge or attack.
For each rule, you choose when it applies: in all modes (default), in Enhanced protection and Under attack modes, or Under attack only. The final action for a request is determined by the priorities of the active rules.
There are three modes in the profile:
- Normal: For standard load. The All modes rules apply.
- Enhanced protection: For suspicious load spikes. The Enhanced protection and Under attack mode rules additionally apply. Smart Protection more commonly applies lenient checks to suspicious traffic.
- Under attack: For an attack or critical load. Rules selected specifically for this mode additionally apply. Smart Protection checks automated traffic more strictly and requires users to pass verification more frequently.
You can configure the mode switching method when creating or editing a profile.
Automatic switching
The service switches modes based on incoming load. The Normal mode is on by default. For the Enhanced protection and Under attack modes, the following are configured separately:
- Activation threshold: Number of incoming requests over a selected interval. If the number of requests over this interval exceeds the threshold, relevant mode gets activated.
- Mode retention time: Delay before returning to normal mode after the load drops below the threshold. This delay prevents frequent switching during load fluctuations.
Estimate the standard load based on traffic monitoring, and the permissible load based on application metrics or load testing results. Set the Enhanced Protection mode threshold above normal peaks with a margin for permissible surges. Set a higher threshold for the Under attack mode – but one below the load level at which the application begins to slow down or throw errors.
Use the same counting interval to compare thresholds. With a one-second interval, you can compare thresholds directly to RPS. After you enable the automatic mode, check if the protection is getting strengthened during normal peak loads and adjust the thresholds as needed.
Manual switching
The selected mode is retained regardless of the load. Manual switching disables automatic control until you turn it back on.
Request body analysis
In the security profile, you can enable request body inspection to improve the web application's performance and security. Limiting the maximum request body size prevents excessive resource consumption and mitigates the effects of DoS/DDoS attacks, where attackers submit large requests in order to exhaust the server's resources.
When you configure a security profile, you can select an action for when the maximum request body size is exceeded:
Do not analyze body: Use it when a legitimate application frequently sends large requests.Block request: This is a universal and secure approach. Smart Web Security blocks any requests exceeding the 8 KB limit, reducing the risk of attacks. If a request is blocked, Smart Web Security returns a403error.
Profiles and rules diagram
The diagram below illustrates the relationship between Smart Web Security profiles and rules. Security profile is the main Smart Web Security component you can use to set up basic rules and Smart Protection. You can additionally connect a WAF profile (through a WAF rule), an ARL profile, and SmartCaptcha.