What Is a Web Application Firewall (WAF)?

How Does a WAF Work?

A WAF safeguards applications by inspecting, filtering, and blocking potentially harmful HTTP/S traffic: some go even further, by preventing unauthorized data from leaving the application as well. The WAF achieves this by analyzing the four critical components of HTTP interactions:

• GET requests: These are used to fetch data from the server.
• POST requests: Used to send data to the server, typically to modify its state.
• PUT requests: Used to send data for creating or updating resources on the server.
• DELETE requests: Used to request the removal of data from the server.

Collectively, if any of these components match a fail state – or the HTML header contains suspicious indicators – the connection is dropped.

This is made possible by a server architecture called reverse proxy: reverse proxies are installed between clients (like a device, or email client) and an enterprise’s application’s internal servers. When a client requests a piece of data from a protected application, the WAF analyzes the request itself, and the context around it. In doing so, it caches the original request – we’ll discuss shortly how this caching can be used to improve performance. Once a request is verified as safe, the WAF establishes its own connection with the internal application, and passes it through.

Able to inspect all traffic entering and exiting the application, the WAF distinguishes between safe and malicious traffic according to policies. These are explicit rules that are set in place to dictate what type of traffic is allowed where. WAFs are available via software, hardware, or as-a-service solutions. No matter the underlying architecture, WAF policies need to be tweaked and tailored to suit the specific requirements of one or multiple web applications. Traditional WAFs require manual updates to these rules in order to stay effective against new vulnerabilities, whereas more modern WAFs leverage machine learning to automate updates.

Next-Gen WAF Features

AI-Powered False Positive Reduction

Application and user profiling are able to detect deviations from normal application and user behavior – but that doesn’t guarantee the alert generated is a genuine indication of compromise. This is how false positives are created, and it’s a major drain on security resources. Next-Gen WAFs address this issue by implementing another layer of analysis; this looks at the wider context of the device, user, or API that’s responsible for an abnormal request. It can then take a more varied response – whether that’s sending a CAPTCHA request, or identifying precisely which API key is exposed and therefore vulnerable.

API Identification and Protection

Users and bots are no longer the only things transferring data into and out of applications: APIs are now a huge part of the data ecosystem. WAFs need to offer comprehensive API discovery and protection. Next-Gen WAFs incorporate API protection by including customizable rules and alerts for API changes and compliance oversight.

Common Threats Mitigated by WAF

WAF threat mitigation relies entirely on the rules and AI engine it’s based on: assuming a correct setup, the following are some of the most common threats.

Injection Attacks

SQL injection attacks are able to take advantage of vulnerabilities within an application’s input fields to inject malicious SQL code into a database query. This allows attackers to manipulate the database, potentially gaining unauthorized access to data, modifying or deleting records, or executing administrative operations. While SQL isn’t the only language used for injection attacks, it’s certainly the most common.

A WAF negates this threat by being able to scan requests for SQL keywords or unexpected characters in user inputs, before they reach the application and interact with the database.

Broken Authentication and Session Management

This describes a whole suite of security risks across the user identity and access control process. It could be insufficiently protected credentials stored in un-hashed format, insecure session IDs that allow attackers to steal and reuse tokens, or sessions that don’t terminate properly.

A WAF can prevent all of these through a variety of different rules: from rate-limiting requests (and therefore blocking credential stuffing requests) to cross-referencing login details against commonly-stolen passwords. Other rules can ensure sessions are invalidated after logout or timeout, blocking further requests with the same token.

Cross-Site Scripting (XSS)

Often called XSS, those attacks are among the simplest to set up and automate against vulnerable sites and apps. A WAF is able to enforce strict rules on input fields to prevent  <,> or script elements – commonly seen in most XSS attacks. Pattern recognition also allows WAFs to identify Indicators of Attack outside of specific tags.

App Components with Known Vulnerabilities

Given today’s app ecosystem, it’s exceedingly common for downstream app components to spring data leaks. WAFs are able to detect if a component with known vulnerabilities is in your environment, as long as that WAF employs a regularly-updated threat intelligence database.

Best Practices for Implementing a WAF

WAF rules are the fundamental building blocks that govern how the firewall functions. But they’re far from the only focus that your WAF management needs to have.

Understand Your Application’s Threats

Each application has a unique threat profile influenced by its functionality, user base, and level of exposure. Begin by identifying the most prevalent and critical threats to your application. For instance, eCommerce platforms are more likely to be targeted by SQL injection attacks, due to their large databases of customer details. API providers, on the other hand, may need to keep a closer eye on parameter tampering vulnerabilities.

Analyze Traffic Patterns

Study your application’s typical traffic behavior to distinguish between legitimate and malicious activity. This analysis allows you to define precise rules to address specific threats effectively. If your WAF is AI-powered, this automatically establishes a baseline of normal traffic and application behavior.

Leverage Managed Rule Groups

Most WAF providers ship their tools with preconfigured rulesets – but check whether they also provide Managed Rule Groups. These are predefined sets of rules that are continuously maintained by the providers. These rule groups address a wide range of threats, including the OWASP Top 10, while also freeing up considerable admin resources.

Prioritize Scalability and Performance

Once up and running, it’s vital to regularly assess the WAF’s configuration and performance. Keep an eye on the KPIs indicative of your security team’s success, like MTTR, while also monitoring any long-term changes to the application’s latency.

With regular check-ups, it’s possible to ensure your WAF supports your application’s growth and user experience even as the organization and user base change.