Web Application Firewall

A Web Application Firewall (WAF) performs the same basic task as a traditional firewall, with the exception that it does so at the application level rather than the network level. A WAF monitors and filters HTTP/HTTPS traffic to and from websites and web applications, protecting them from malicious activity.

A WAF employs a multi-faceted approach to protect websites and web applications. Some of the most common methods used to achieve this  include allowlists, denylists, regex, and heuristics:

Allowlists

As the name suggests, an allow list specifies which requests are allowed. Requests not on the list are blocked. This is a strict approach, and is typically applied when known safe input or behaviour should be permitted. However, the strict nature of an allowlist may cause some legitimate requests to be denied if not configured correctly. One example of an allowlist implementation is where a form field expects a numeric value; anything other than the expected numeric value will be denied.

Denylists

Denylists contain entries of IP addresses, user agents, specific strings, etc. that are forbidden. Denylists can be very effective against known attack patterns, but are ineffective against new or unknown attacks. As such, it’s critical to keep a WAF current with new threat intelligence. Denylists are typically static, meaning they don’t change unless manually updated. They can be seen as a set of “hard rules.”

Regular Expression-Based Rules

Regular expressions, or regex, are a powerful tool for pattern matching and string manipulation that are typically used to match patterns of common attacks (e.g. SQL injections). A key difference between regex and allowlists / denylists is that regex can be used to detect variations in common attacks, while allowlists / denylists require explicit static definitions.

Heuristics

Instead of looking for a specific string or pattern, heuristic checks might analyse the behaviour or structure of a request. For example, a sudden surge in requests from a single IP or unusually large payloads might be flagged as suspicious. For heuristics to be effective and to minimise the potential for false positives, it requires careful tuning and continuous monitoring. Unlike allowlists, denylists, and regex to an extent, heuristics can detect previously unknown threats or zero-day exploits.

In addition to these methods, modern WAFs can also incorporate other advanced techniques such as machine learning, threat intelligence integration, behavioural analysis, geo-blocking, and rate limiting. A well-configured WAF uses a combination of these methods to provide robust protection against a wide range of web application threats.

Traffic analysis. A WAF analyses incoming and outgoing web traffic to identify patterns, sequences, or behaviour.

Filtering. WAFs use allowlists, denylists, regex, heuristics, as well as other more advanced methods to detect and block threats like SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF), among others. These rules can be customised based on the needs of the specific application.

Blocking / Alerting. When malicious activity is identified, it will either be blocked by the WAF, or an alert will be sent to system administrators. This depends on the WAF configuration.

Other WAF functionality includes:

• Virtual patching. A WAF may automatically patch vulnerabilities in websites or web applications by creating a custom rule. However this shouldn’t be regarded as a permanent fix, but rather a temporary measure put in place until the vulnerable code can be fixed.
• Bot protection. WAFs provide protection against bots. They are capable of distinguishing between bot traffic and legitimate human users, and so provide protection against automated attacks and scraping.

• API security. Some WAFs offer protection tailored specifically for API endpoints, ensuring that they are shielded from misuse and abuse.
• 3rd Party integration. WAFs can often integrate with other security systems, such as intrusion detection systems (IDS), intrusion prevention systems (IPS), and security information and event management (SIEM) systems, creating a layered and comprehensive security approach.

The Open Web Application Security Project (OWASP) is a global non-profit organisation focused on application security. OWASP provides freely-available articles, methodologies, documentation, tools, and technologies to create awareness of, and enhance online application security.

A Web Application Firewall (WAF) offers several benefits to protect web applications and improve their overall security posture. Here are some of the primary benefits:

1. Protection Against Common Web Vulnerabilities: WAFs are designed to protect against a variety of web-based threats and vulnerabilities, including those outlined in the OWASP Top 10, such as SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF).
3. Defense Against Zero-Day Exploits: Some advanced WAFs can detect and block previously unknown vulnerabilities or zero-day exploits using heuristic analysis and behaviour-based detection mechanisms.
5. DDoS Mitigation: While traditional DDoS protection focuses on the network layer, WAFs can help protect against application-layer (Layer 7) DDoS attacks, which target specific aspects of a web application.
7. Rate Limiting: WAFs can limit the number of requests a user or IP can make within a specific timeframe, helping to prevent application abuse and DDoS attacks.
9. Customizable Rules: Organisations can tailor WAF rules to their specific application needs, allowing for a balance between security and usability.
11. Centralised Security Management: WAFs provide a centralised point of control for monitoring and managing web traffic, making it easier to enforce consistent security policies across multiple applications.
13. SSL Termination: Many WAFs can handle SSL termination, offloading the performance cost of encrypting and decrypting HTTPS traffic from the web servers.
15. Geo-blocking: WAFs can block or allow traffic based on geographic origin, which can be useful for both security and regulatory compliance.
17. Compliance: For industries subject to regulations like PCI DSS, HIPAA, or GDPR, using a WAF can be a key component in meeting certain security requirements.
19. Improved Performance: Some WAFs come with integrated content caching, which can reduce the load on backend servers and improve an application’s response times.

While Web Application Firewalls offer numerous benefits, it’s important to understand that they are just one component of a comprehensive security strategy. Regular application patching, secure coding practices, and other security measures should be employed in conjunction with a WAF for optimal protection.