Banko Stoyanov
WAF (Web Application Firewall) or web application firewall helps protect web applications by filtering and monitoring HTTP traffic between a web application and the Internet.
Typically, a WAF protects web applications from attacks such as cross-site forgery, cross-site contamination, cross-site scripting (XSS), file inclusion, and SQL Injection.
WAF is a layer 7 protocol in the OSI model (Layer 7) and is not designed to protect against all types of attacks. This attack mitigation method is usually part of a suite of tools that together create a comprehensive defense against multiple attack vectors.
By deploying a WAF in front of a web application, a shield is placed between the web application and the Internet. While a proxy server protects the identity of a client machine by using an intermediary, a WAF is a type of reverse-proxy that directs clients to go through the firewall (WAF) before reaching the server.
How does WAF protection work?
A WAF works through a set of rules, often called policies. These policies are intended to protect the application from vulnerabilities by filtering malicious traffic.
The value of a WAF comes in part from the speed and ease with which policy modification can be implemented, enabling a faster response to different attack vectors and during a DDoS attack. Rate Limit can be quickly implemented by modifying WAF rules. A good example of WAF is Mod security, which is included and automatically turned on within all plans of CooliceHost.
What is the difference between Blocklist and Allowlist WAFs?
WAF, which works on the basis of a list of blocked addresses (Blocklist), implements protection against known attacks. The list of permitted addresses (Allowlist) allows only traffic that has been previously approved.
Blocklists and Allowlists have their advantages and disadvantages, so many WAFs offer a hybrid security model that implements both.
What are network-based, host-based and cloud-based WAFs?
A WAF can be deployed in one of three different ways, each with its own advantages and disadvantages:
- Network-based – are usually hardware-based. Because they are installed locally, they minimize latency, but network-based are the most expensive option and require storage and maintenance of physical equipment. Also, in the most general case, they can process the highest volume of traffic as quickly as possible.
- Host-based – can be fully integrated into the application software. This solution is cheaper than network-based WAF and offers more customization options. The disadvantage of host-based WAF is the consumption of local server resources, implementation complexity and maintenance costs. These components usually require engineering time and can be expensive.
- Cloud-based – offer a more affordable option that is very easy to implement, they usually offer a turnkey installation that is as easy as a DNS change to redirect traffic.
Cloud-based WAFs also have minimal costs, as users pay monthly or annually for security as a service. Cloud-based WAFs can also offer a solution that is constantly updated to protect against the latest threats without additional work or cost on the part of the user.
The disadvantage of cloud-based WAF is that users pass the responsibility to a third party, so some features of WAF may be unknown to them.
Banko Stoyanov
