The global cybersecurity threat landscape has been growing dramatically over the past few years, a trend that’s likely to continue. New types of threats are being discovered by cyber teams and researchers every day. Thus, no network can survive without adequate protection.
Web application firewalls (WAFs) are among the solutions that help protect today’s networks from many types of cyber threats. How? Using a WAF for cybersecurity allows security teams to automate filtering and monitoring of HyperText Transfer Protocol (HTTP) traffic between web applications and the Internet. As such, they safeguard against attacks like cross-site forgery, cross-site scripting (XSS), file inclusion, and Structured Query Language (SQL) injection, among others.
How Does a WAF Work?
Organizations use WAFs to filter HTTP traffic that flows from the Internet to web applications and vice versa. That way, command-and-control (C&C) servers can’t communicate with malware or the bots under the control of threat actors.
Without a WAF, both legitimate and malicious HTTP traffic can enter a network. While legitimate traffic may be welcome, malicious traffic could result in downtime, data theft, or even malware installation. WAFs are thus installed on web applications connected to the core infrastructure to screen all traffic and only allow legitimate traffic to pass through.
Most WAFs support a variety of capabilities, including providing visibility, enabling compliance, monitoring for threats, and enforcing security policies.
Positive and Negative WAF Security Models: What’s the Difference?
Two types of WAF cybersecurity models exist—positive and negative.
The positive security model requires using a whitelist or an allowlist to filter traffic according to a list of permitted elements and actions. That means anything not on the list gets blocked. As a result, it can block new or unknown attacks that the developer didn’t anticipate.
The negative security model, meanwhile, uses a blacklist or denylist that prevents the entry of specific items. That means anything not on the list gets to pass through. While a denylist is easier to implement, it can’t address all threats. It also requires keeping a long list of malicious signatures, since the level of security depends on the number of restrictions it implements.
How Are WAFs Implemented?
WAFs can be implemented in various ways, although each comes with its pros and cons. Learn about them below.
Network-Based WAF
This type of WAF is hardware-based. That means that it is installed locally to minimize latency. While that’s a plus, network-based WAFs are often the most costly option, and they require the same amount of storage space and maintenance as physical equipment.
Host-Based WAF
Host-based WAFs can be fully integrated into a web application’s software. As such, they cost less than network-based WAFs and offer more customizability. The downside? They consume a lot of local server resources, are complex to implement, and necessitate high maintenance costs.
Cloud-Based WAF
This WAF type is likely the most affordable option and is quite easy to implement. All it takes is a turnkey installation that is as easy as changing Domain Name System (DNS) settings to redirect traffic. It requires minimal upfront costs, since users can pay monthly or annually for this security service on a subscription basis.
Cloud-based WAFs also come as solutions that are consistently updated to protect against the latest threats without any additional work or cost on the user’s end. The drawback? Users hand over the responsibility to a third party, making some features a black box.
What Capabilities Make for an Effective WAF?
Every WAF is different, but we can expect a good one to have these capabilities:
- Can detect attacks in real-time and prevent them from affecting application runtime environments
- Can provide automated application programming interface (API) protection so endpoints stay protected as they get published, shielding applications from exploitation
- Can prevent business logic attacks from all access points, including websites, mobile apps, and APIs
- Can help admins gain seamless visibility and control over bot traffic to thwart online fraud
- Can block attack traffic to ensure business continuity with guaranteed uptime and no performance impact
- Can ensure complete visibility with machine learning (ML) and domain expertise across application security stacks to reveal noise patterns and detect application attacks
- Can provide visibility and control over third-party JavaScript code to reduce the risk of supply chain fraud, prevent data breaches, and stop client-side attacks
The Verdict
No matter what kind of WAF your organization chooses to implement and how it blocks or accepts traffic, it would help if it has the capabilities that make for effective network protection. What matters in the end is that it thwarts threats at the point of entry.
