What is Web Application Firewall (WAF)? Types & Benefits

Did you know that over two thirds of web applications have critical security flaws? That is what Veracode found when it scanned 130,000 applications for vulnerabilities, finding some 68% had a flaw that fell into the OWASP Top 10. 

Extortion via ransomware or threats to publish sensitive data is a key motivator. Again, the size or type of the organization is not necessarily significant to make these attempts worthwhile. 

“A Web Application Firewall (WAF) builds on and enhances traditional firewall security protection. Traditional firewalls don't stop encrypted HTTPS traffic as they have no visibility of the content within. A Web Application Firewall, which is logically placed between standard firewalls and web servers, operates at Layer 7 of the network stack. It can decrypt HTTPS web traffic and inspect the data content. In conjunction with lists of known attack methods, the Web Application Firewall can deny access to web servers when potentially malicious requests are detected,” the Progress/Kemp glossary explained.

• Defense for web applications - Businesses and other organizations depend on web applications for critical operations and customer engagement, making them prime targets for cyberattacks. WAFs act as a frontline defense, sitting directly in the web traffic path between endpoint devices and web application servers, looking for security issues in the traffic before it can reach the applications.
• Security that goes beyond traditional defenses – WAFs analyze how web traffic using HTTP/HTTPS protocols works and inspect these network packets to look for threats. This means that WAFs can prevent threat exploits that tools like network firewalls can’t detect. It’s worth repeating that WAFs do not replace traditional network firewalls. It augments them (and other security tools) by adding additional security inspections and checking network traffic in a different and complementary way.

As part of a layered security approach, a WAF can deliver logging and event information to external security and monitoring services. The WAF technology uses a set of rules that provide protection against a wide range of attacks – this set of rules has evolved over the years to provide coverage for new and emerging threats. In the case of the WAF available with Progress/Kemp LoadMaster, these security rules are updated automatically on a regular basis. 

Using the LoadMaster WAF as an example, this WAF’s rules provide protection against the major vulnerabilities identified in the OWASP TOP 10. 

OWASP are an independent, industry supported group who focus on application security and annually conduct research into application security. Over the years, the vulnerabilities in the OWASP top 10 have changed as new exploits become more common and older exploits have been mitigated over the years as application vendors fix vulnerabilities. The rules provided by LoadMaster include these older vulnerabilities, alongside application specific protection. 

In the below example, we see a normal access where a user accesses their own account. However, if they modify the parameter on the HTTP request, they are allowed to access someone else’s account. Again, not exactly a desirable outcome. 

These two are very simplistic – applications should be coded much better than this - but they may still be susceptible to well-crafted attacks designed to exploit a very specific weakness.

Application weaknesses may be inherited from 3rd party or open-source components, which when updated may introduce new vulnerabilities. This is why application protection should be ongoing and not just based on periodical security checks such as app penetration tests. 

There are three main types of web application firewalls: 

• Cloud-based WAFs are delivered as a service and the firewall exists completely in the cloud.
• Hardware-based WAFs are hardware devices deployed on a LAN.
• Software-based WAFs are generally deployed via a virtual machine and can run in the cloud or on-premises. 

• Cookie Tampering 
• Injection Attacks
• Cross-Site Scripting (XSS)
• Data Loss Prevention (DLP)
• Buffer Overflow Protection
• Access Control
• Security Misconfiguration
• Real-Time Protection
• Denial of Service Protection
• Botnet Attack Preventions
• Web-Based Malware Protection
• Zero-Day Threats