Web application firewall (WAF)
We deploy a WAF in front of your public web applications and portals to stop application-layer attacks such as injection and automated abuse.
What it protects against
Attacks on the application layer
A network firewall lets web traffic through, because that traffic has to reach the server. The WAF looks inside that traffic and inspects each request.
OWASP Top 10 threats
A community-maintained list of the most common security flaws in web applications, in order of priority. Most testing methodologies are built on it.
Injection
The attacker slips a command disguised as data into a database query (SQL injection). The same type of flaw also occurs in command interpreters and in LDAP.
XSS
Cross-site scripting: the attacker gets a script into the page, which then runs in the visitor’s browser. This can be used to steal a session cookie or to carry out actions on the user’s behalf.
Automated abuse
Machine-generated requests repeated at scale, for example trying password after password at the login page or harvesting data in bulk from an endpoint.
Rollout
How the WAF goes live
We turn on blocking once the rules match the application’s real traffic.
-
Assessment
We list the web applications and portals reachable from the internet and record what needs protecting in each one.
-
Deployment
The WAF goes in front of the applications. We set the rules per application, because each one receives different requests.
-
Go-live
In learning mode the WAF logs suspicious requests but does not block them. During this phase we weed out legitimate traffic that was flagged by mistake, and only then do we switch to blocking.
-
Handover
You take over the system along with documentation of its settings and rules.
Deliverables
What you get at the end
items handed over
- An assessment of the applications to be protected
- A deployed WAF with rules tuned for each application
- Protection running in blocking mode after a learning phase
- Handover documentation
Technologies and references
What we use and where
We deploy web application firewalls from the Fortinet portfolio. We have an active partnership with the vendor and hands-on deployment experience.
References
- Hungarian Dance University
- FortiWebA FortiWeb-based WAF protects the web servers and web-based services published to the internet.
- Municipality of Gödöllő
- We put a WAF into operation in front of the published web servers and web-based services. Because of the office’s international ties, attacks arrive constantly and geographic restrictions can be applied only minimally, so we used Security Profiles built specifically to protect web servers.
Related services
What goes with the WAF
The WAF protects the web application. The network perimeter, log analysis, and software updates are covered by other services.
Firewall and VPN
Design, installation, and configuration of next-generation firewalls, together with VPN for site-to-site and remote access.
SIEM
WAF logs are among the highest-signal log sources, because the events arrive already filtered. We also connect these logs to the SIEM.
Patch and update management
Centralized, scheduled management of operating system and application updates. The software running behind the WAF has to be kept up to date as well.
Frequently asked questions
The questions we hear most
If we have a WAF, do we still need to fix flaws in the web application?
Yes. A WAF prevents a flaw from being exploited, but it does not fix the flaw. When prioritizing vulnerabilities, it matters whether a WAF sits in front of the application, but the fix still has to be made. Parameterized queries are what protect against injection, and input filtering is no substitute for them, because it can be bypassed.
Does a WAF protect against distributed denial-of-service (DDoS) attacks?
Not against volumetric attacks. These saturate your bandwidth and can only be filtered by your internet provider or a specialized service, because your own device would itself become the bottleneck. An application-level attack uses little traffic to overload a resource-intensive operation, such as search or login. Per-user and per-IP rate limits protect against this, and such limits can also be set on the WAF. Our article on DDoS defense has the details.
Does the WAF protect APIs too?
An API call is also an HTTP request, so the WAF can be placed in front of an API as well. But it will not catch the most common API flaw, a missing object-level authorization check, because the request is technically valid: this has to be fixed in the API itself, on the server side. The WAF protects only the APIs that sit behind it, and the most common entry point is exactly the forgotten API that does not appear in any inventory.
