How a web application firewall improves security

If you’re connected to the internet (as most businesses are), then it’s only a matter of time before you receive your first cyberattack. It might come in the form of simple malware, email phishing or something as coordinated as DDoS. But no matter what form it takes, one thing is clear – you will need to defend against bad actors, especially when it comes to your website and web applications. So, today we’re discussing how a web application firewall improves security – putting a barrier between your critical infrastructure and them. We’ll share what a web application firewall or WAF is and what it does. Plus, we’ll explore some popular providers and how you can customise your deployment to work perfectly for your organisation.

What is a web application firewall (WAF)?

A web application firewall or WAF monitors and filters all your web traffic to keep your website and other online applications secure. It looks for patterns and anomalies in internet traffic to protect you from attacks. It’s similar to a network firewall which looks at all traffic on your network except it’s hyperfocused on just your website or web applications. In fact, using both together is ideal to get better coverage. And good WAFs today will learn and adapt, detecting threats before they ever fully materialise

What types of attacks does it prevent?

A WAF protects you from most cross-site scripting (XSS or CSS) where bad actors try to get malicious code into your system via websites you do trust. It also helps against cookie poisoning where your tracking session is hijacked to try and get data. Also, a web application firewall prevents SQL injections via a web form that can hack into your back-end database via poor user input validation. It can also help prevent logging and monitoring failures, cryptographic failures, broken access control, server-side request forgery, design holes, data integrity issues and more.

Key features of a web application firewall (WAF)

So what should you be looking for in a WAF? Well, any good web application firewall should have:

  • A reference database for what bad traffic looks like and known bad actors
  • AI to look at traffic in real-time and flag any anomalies
  • Profiles for the application so it knows what requests should look like
  • The ability to customise the rules to your organisation’s needs
  • Traffic triage and blocking functions
  • DDoS protection
  • Multiple points of presence for content delivery
  • Protection from automated bots

 

How to customise a web application firewall (WAF)

As we mentioned above, the best web application firewalls will allow you to customise them to your needs. And there are a lot of ways to do just that. However, in our experience across multiple deployments, we’ve found two considerations beyond configuring your security policies are the key to success:

Choosing the right security model
  • Whitelist or positive model – here you only allow expected requests. It is very secure but could lead to legitimate traffic getting blocked, so it must be tuned correctly.
  • Blacklist or negative model – here you allow everything, but the WAF is constantly scanning for threats and blocking known bad actors. This requires consistent machine learning or libraries will become obsolete fast.
  • Hybrid model – Here you combine both models to minimise their drawbacks.
Adding in AI-ML

Choosing to enable machine learning and AI will help your web application firewall get smarter. You can train it on your own data (to supplement the libraries) so it can more accurately minimise attacks on your specific organisation. Plus, advanced systems like an AWS-native WAF can even integrate with other tools like AWS Shield Advanced for blanket protection and rapid response notifications.

Choosing the right web application firewall (WAF)

Once you know you need a web application firewall, the next step is choosing the right one. There are on-premise providers you install and maintain yourself, cloud options that are scalable and affordable or hybrid models that do a bit of both. Talk to an expert if you’re not sure what installation would work best for your environment. At a minimum, you want to make sure any web application firewall or WAF has rule-based detection, rule and policy creation plus anomaly detection and smart learning features. Without all these features, your system will become rapidly outdated.

Popular web application firewall (WAF) providers

While there are a lot of options on the market, here are a few of the more popular WAF providers:

AWS-native WAF

A cloud-based AWS-native WAF improves the security of your applications and works seamlessly with Amazon CloudFront, Application Load Balancer, Amazon API Gateway and AWS AppSync. It’s great for reducing your risk, protecting your data, improving compliance and boosting your organisation’s security profile overall.

Cloudflare

A network and WAF in one, Cloudflare is an integrated system that delivers content close to the request origin and protects its clients from malicious activity like DDoS attacks, malicious bots, and other nefarious intrusions. It’s a silent protector, running in the background of millions of websites and online services. And it offers a safe platform for Javascript code and a number of other amazing developer tools.

Fortinet

A cloud-based WAF, Fortinet protects from zero day and the 10 major OWASP threats all while being hosted in the cloud. That makes it great for organisations that need to scale and want affordability and security with a name they can trust. 

Sitelock

Another leading WAF cloud security service, this one blocks backdoor access, all 10 OWASP threats and prevents bots from getting in, claiming 99.99% accuracy. Also, you could get set up in as little as 5 minutes.

Citrix

Pitched for enterprise-level organisations, the Citrix WAF protects websites, APIs and apps from layers 3 to 7 and against all core threats. It works with Microsoft Sentinel and supports common events format for better threat intelligence. 

 

Hopefully, you now understand how a web application firewall improves security in your organisation. But with so many amazing options for web application firewall providers, it’s easy to be overwhelmed by choice. Let us help you cut through the noise and find the ideal WAF for your environment today. Just get in touch and take that first step into enhanced security.