Published 22/02/2021 – est. 4 minutes to read.
With the rise of web threats
Any web application needs a proper firewall to protect it from cyberattacks. In most cases, the most appropriate type of firewall is a Web Application Firewall, often referred to as a ‘WAF’.
A WAF can be network-based or cloud-based and is often deployed in front of one or more websites or applications. Running as a network appliance (virtual or physical) or a Cloud service, the WAF inspects each packet and uses a rule base to analyse Layer 7 Web Application logic and filter out potentially harmful traffic that can facilitate web exploits.
Some network-based WAF options include:
- An open-source WAF such as ModSecurity
- A commercial WAF such as the F5 WAF
- A cloud vendor’s native WAF, such as the AWS WAF or Azure WAF
Another option is a Cloud-Based WAF service to protect your web application from online threats automatically and ‘in the cloud’. There are significant benefits to taking this approach, including stopping threats before they reach your Web Application, as all incoming traffic passes through the Cloud-Based WAF.
In some cases, you might implement both – yes, both, the ultimate WAF protection, some might say!
Some examples of a Cloud-Based WAF service include:
Cloudflare is a major player in this space, with a large market share, and it protects against malicious attacks that exploit vulnerabilities, including SQLi, XSS, and more, by simply enabling the OWASP Core Rule Set. To quickly protect against new and zero-day vulnerabilities, you can also turn on Cloudflare’s Managed Ruleset. As the vulnerability landscape evolves rapidly, Cloudflare updates Managed Rulesets regularly to provide fast, seamless protection against the latest attack vectors.
There is also flexibility to build your own Firewall Rules with attributes including user-agent, path, country, query string, IP address, and more. Simulation mode enables you to quickly test your newly created rules before deploying them live.
To summarise, if you have a Web Application and want to protect it from internet-based threats, you need a WAF. Cloud-based WAF services are great; the provider does much of the heavy lifting, and they are relatively simple to set up. For the ultimate protection, you may want to implement both, but this depends on your Organisation and risk profile.
We hope you have enjoyed reading our first Blog of 2021! The Cyber Security Specialists team.
To evaluate your Web Application Firewall (WAF), conduct a Cloud Security audit, or discuss our services, connect directly with our technical team:
Telephone: 0161 706 0244
Email: info@cybersecurityspecialists.co.uk
Related Pages
