What is a web application firewall (WAF)?

A web application firewall is a network security device that creates a secure barrier between web apps and the external internet. WAF systems filter HTTP traffic to track threats, and apply security policies to allow or block access to web applications.

Web application firewall solutions also protect against web application attacks like SQL injection and cross-site scripting (XSS). These attacks are common vectors for data breaches. Application-focused firewalls reduce the threat surface and make critical attacks much less likely.

This article will look in more depth at how web application firewalls work, and how they protect network resources. We will assess their benefits and potential drawbacks. This will give you solid knowledge of whether Web Application Firewall solutions will help secure your network.

How does a web application firewall (WAF) work?

Like remote proxies, web application firewalls filter traffic arriving at the network edge before it communicates with local servers. But they do so at OSI Layer 7, and only deal with web applications.

A web application firewall enforces security policies between web applications and clients seeking network access. If users meet security conditions, the firewall allows access. Up to that point, there is no direct connection between users and servers.

There are many types of WAF. For instance, IT teams can install WAF technology on hardware appliances. Software-based web application firewall solutions operate as server plug-ins. And more advanced cloud WAF systems provide security-as-a-service.

All WAFs specialize in filtering HTTP traffic. They offer strong protection against common web threats such as XSS or SQL injection. WAF systems also respond quickly to DDoS floods on web servers.

Web application firewall systems also manage access to server content by applying allowlists or blocklists. Allowlists block access requests from all users unless they are listed in the firewall security policy. Blocklists operate in reverse. They allow every request unless the IP address is specifically blocked.

However, web application firewall tools have some limitations. Most importantly, they do not filter other protocols such as FTP or SMTP. WAFs are only designed to protect web assets.

As a result, WAF systems usually form part of wider cybersecurity architecture. They are a critical component of internet security. But organizations may need additional tools to block traffic and protect data.

Key points about web application firewalls

• Sit between web servers and the external internet.
• Filter incoming and outgoing traffic. Separates the server from internet users.
• Operate at OSI Layer 7 (the Application Layer).
• Can allow or block individual users, or determine levels of access to web content.
• Only defend against HTTP-based attacks such as SQL.
• Available as hardware appliances, server applications, or cloud solutions.

The different ways to deploy a WAF

Web application firewalls always protect web applications. But there are various types of web application firewalls. Before discussing the main architecture options, it's important to note that WAFs can be proprietary or open source.

• Open-source web firewalls are becoming increasingly popular. They are easier to customize, provided organizations possess development expertise. And open source versions benefit from the skills of the global OWASP community. Community input from OWASP helps to neutralize emerging exploits and SQL vulnerabilities.
• Vendor-sourced WAF. Companies can also purchase off-the-shelf application firewalls from vendors. This option simplifies installation. But users will have fewer customization options. They will also need to trust their vendor to supply updates and maintain up-to-date threat databases.
  
  

Aside from open source vs vendor-sourced solutions, there are three main ways to deploy WAF as network security tools.

Network-based WAF

Network-based web application firewall technology protects local network assets. This type of WAF is usually installed on a hardware appliance. The web firewall device connects to local servers and the external internet. It filters traffic as it arrives and leaves, not unlike the role of a reverse proxy firewall.

Network-based WAFs often deliver high speeds and low latency. This is because they are installed extremely close to the assets they protect. But there are disadvantages. Hardware devices cost more to install. They also need space, which can be scarce in office settings. And all hardware appliances will need regular maintenance.

Host-based WAF

Hosted web application firewalls are installed on network hosts. They generally integrate with the applications they protect. This provides users with more flexibility than other WAF solutions. Technicians can toggle access settings for each web application and set priorities for the most sensitive network assets.

The downsides of host-centered web firewalls include high data consumption. Installing WAF systems for each core application can reduce network capacity. Software firewalls are often complex to set up. Multiple WAFs may be needed for different workstations or servers. They take time to install and can become expensive in some cases.

Cloud-based WAF

Cloud-hosted web application firewall systems protect Software-as-a-Service (SaaS) applications stored in a public or private cloud. Locally hosted web firewalls struggle to protect cloud assets. But cloud WAFs are designed to regulate traffic flows to SaaS applications. This makes them the only secure web firewall option when protecting cloud-stored data.

Cloud WAFs are generally purchased via subscription models. Users purchase coverage from cloud security providers (CSPs). The CSP maintains the cloud firewall. They will apply updates and counter emerging threats. And cloud firewalls are usually simple to install. They simply bolt onto cloud environments to provide instant coverage.

Most major cloud platforms provide firewall services. For example, AWS (Amazon) allows users to create individual app security policies. Users can track threats, block exploits, and monitor access requests.

Alongside basic security, cloud firewalls have another important benefit. They integrate with cloud development processes. DevOps teams can add new content or services to virtual environments securely. Companies can develop and reshape cloud deployments without compromising safety.

On the negative side, cloud-hosted web application firewalls are always managed by third parties. Users hand over some control to their security partners. There will be fewer customization options as well. But for many cloud-reliant companies, this is a worthwhile trade-off.

Attacks that WAFs prevent

Web application firewall solutions can neutralize many of the most common web security vulnerabilities. This matters because web attacks are a frequent cause of damaging data security breaches. Here are some of the most common web exploits that a WAF security model will defend against.

Cross-site scripting (XSS)

Cross-Site scripting attacks involve the injection of client-side scripts into publicly viewable web pages. Attackers turn a harmless website into a source of malicious Javascript. When executed, this code can take over the user's computer. If the attacker is lucky, they might assume control of network assets. They can then extend their attack to steal data or damage infrastructure.

WAFs are an effective XSS countermeasure. The web application firewall applies security policies to filter access requests and block suspicious digital signatures. This catches most stored cross-site scripting attacks.

SQL injection attacks

SQL injection attacks use unsecured web forms to "inject" malicious code into websites. By entering the right code, attackers can compromise servers behind the web form. They can read data held in SQL databases. Attackers may gain write or delete privileges. They can even access operating systems and roam beyond the targeted database.

WAFs protect against SQL injection by identifying threats before they reach high-value servers. Blocklists can screen known threats. And WAFs may also feature triage features to quarantine SQL attacks without taking down operational resources.

Distributed-denial-of-Service attacks (DDoS)

DDoS attacks direct a stream of traffic at targeted web servers. If the traffic flood is dense and large enough, the server may be forced offline. This leads to lengthy downtime and additional costs. DDoS floods can also be a cloak for more damaging vectors. For example, the traffic flood could conceal malware injection to harvest customer data.

Companies can protect web servers against Layer 7 DDoS floods by using a web application firewall. Many WAF systems deliver DDoS protection by applying rate limiting. This automatically limits the number of access requests if traffic passes a certain threshold.

Threat detection systems operate in the background. If attackers seek to implant a payload during DDoS assaults, the WAF should detect malicious agents.

Web scraping

This attack seeks to extract data from websites without the permission of site owners. This is not usually intended to damage the site itself. But websites contain valuable intellectual property and company investments. Thieves can use scraped data to set up copies for their own purposes. This could include malicious websites that look like the real thing.

WAFs help here by detecting suspicious access requests. Data scrapers must make thousands of requests - usually from the same IP address or group of IP addresses. The WAF will detect this pattern and add scrapers to the firewall blocklist.

Unauthorized data extraction

Alongside the specific web threats listed above, web application firewalls help to track various types of malicious traffic. This includes data packets containing documents or files that should stay inside the network perimeter.

A WAF enables IT teams to create data protection policies for each web application. The firewall can track HTTP traffic and detect whether users are transferring sensitive data. This is even more effective when used with Data Loss Prevention (DLP) tools. These systems set security controls for high-value data and track documents wherever they go.

WAF use cases

Web application firewalls are being used at this moment to secure web servers and online content. The WAF security model has a range of use cases. This makes it a common addition to corporate cybersecurity architecture. Let's run through a few practical use cases to show how valuable the technology can be.

Web site protection

Most importantly, web application firewalls protect the applications used to deliver web services. Most customer-facing companies use online sales portals and forms to sell products. Customers and companies interact via web applications. And these applications are a prime target for malicious attackers.

WAFs filter and track HTTP traffic. They monitor activity across API endpoints, including cloud-hosted assets. The WAF maintains threat visibility and detects attacks quickly before they compromise assets. This ensures smooth eCommerce activities, remote work, and customer management.

Downtime prevention by DDoS protection

Companies must maximize network uptime. Any outages can dent the bottom line and cause reputational harm. But to ensure reliable operations companies need robust protections against denial-of-service attacks.

WAF systems provide strong DDoS protection. When bots swarm and attack web servers, the web firewall applies rate limiting to keep traffic flows in check. They also track bot behavior to prevent data extraction and defeat data scrapers.

Data security compliance

Data protection is a regulatory priority for all companies. Standards like GDPR, CCPA, and HIPAA mandate robust data security policies. Governments across the world are seeking to penalize poor security and protect the data of citizens. And poorly secured web applications are likely to incur large fines.

Web application firewalls have many compliance benefits. For instance, WAFs guard credit card payment portals. They prevent SQL attacks that steal financial data. Web firewalls protect healthcare records, banking data, and student information. Any data stored behind web applications requires specialized firewall protection.

Simple content management

Companies often want to manage the content available to local network users. For example, as part of their security model managers might block social media sites during working hours. Or security teams could maintain blocklists of phishing-related websites. And schools may block unauthorized access to all adult content.

A web application firewall helps to manage web content access. IT teams can use the firewall's HTTP filtering capabilities to allow or deny access to individual websites. DNS redirects make it easy to control which sites are visible to local users.

Apply patches and counter exploits

Web applications can develop vulnerabilities due to outdated versions. Vendors don't always deliver automated patches to clients. Patching schedules can be slow and unreliable. Moreover, IT teams aren't always able to devote enough time to update every application promptly. This creates space for zero-day exploits to cause carnage.

WAFs provide an insurance policy against exploits. Even if web applications are unpatched, the firewall offers constant security. It tracks network traffic and blocks malicious activity. And in some situations, web firewalls are the only viable security option. For example, if companies rely on legacy apps that are no longer updated.

Cloud WAF vs on-premises WAF

Web application firewalls have many use cases and benefits. But there is one important question to answer. Should network managers choose next-generation cloud firewalls? Or do older on-premises WAF solutions offer sufficient security?

This is an urgent practical question for many companies. And the answer is simple. Companies should choose the right web firewall for their networking needs.

On-premises WAF

On-premises web firewalls are ideal for securing locally-hosted web content. A web application firewall can secure remote access gateways to locally-hosted apps and private clouds. WAF solutions can also effectively protect web servers connected to the external internet.

Hardware firewalls are adaptable and remain totally under the control of local IT professionals. Companies can extend security rules to their web servers and apply granular security policies for each web application.

However, on-premises web firewalls are complex to install and maintain. If companies plan cloud migrations in the future, their web firewall may swiftly become obsolete. And it is not easy to estimate firewall capacity needs. Adding more capacity can become expensive. So hardware firewalls are less well-suited to companies that plan to grow.

Cloud firewalls

Cloud WAF is delivered in the form of security-as-a-service. WAFs in the cloud are managed by separate cloud vendors, who sell coverage on a subscription basis. The firewall secures all cloud applications, and clients can set security policies via centralized dashboards.

Cloud WAF is a reliable way to lock down SaaS applications and confidential data held on cloud containers. The cloud firewall tracks access and blocks threats – generally more efficiently than on-premises alternatives. It gathers data for audit purposes and neutralizes cloud DDoS attacks.

WAF in the cloud also scales smoothly. Users can purchase extra capacity in the vendor's virtualized data center. There are few limits to data processing capacity or the size of a client's cloud deployment. Cloud WAF is therefore a sound option for companies with growth potential.

FAQ

What does WAF mean?

WAF stands for web application firewall. Web applications are apps hosted on web servers. These servers could be locally hosted or stored in the cloud. Firewalls are network security tools that filter traffic and block malicious access. When combined with web apps, firewalls block attacks on websites and keep user data safe from data thieves.

What is the difference between WAF and a firewall?

A web application firewall is a type of firewall, but there are many other varieties. For instance, you will find next-generation firewalls, packet filtering firewalls, proxy firewalls, and hardware firewalls. The key aspect of WAF is that firewall protection extends security rules to web applications. WAFs only filter HTTP traffic. They will not protect general network infrastructure or track TCP/IP transfers.

Is WAF a DDoS protection?

Yes, in many cases. Distributed denial-of-Service attacks seek to flood servers with traffic. The aim is to take servers offline and cause damage to networks and websites. A web application firewall can prevent DDoS floods by detecting suspicious traffic and regulating access requests. If the firewall keeps request rates low, the server should remain online and healthy.