Web applications are arguably the most important back-end component of any online business. They are used to power many of the features most of us take for granted on a website
2. What is Web Application Firewall?
Web Application Firewall (WAF) protects web and cloud applications against known and unknown
attacks at the application layer (such as SQL Injection, Cross Site Scripting or more general OWASP
Top10).
1.
Examine within the data payload ,beyond simple the IP or TCP headers
2.
Perform โDeep Packet Inspectionโ
3.
Detect and respond to signatures for known application vulnerabilities
4.
Do not require modification to existing application code
4. Common WAF Features
โ
Network Protocol Filtering
โ
HTTP Protocol Filtering
โ
Stateful Connection Monitoring
โ
Cookie Monitoring /Protection
โ
Hidden Field Enforcement
โ
Brute-Force Monitoring
โ
Honeypot/Honeynet Integration
5. Benefits of a WAF
โ
Application attacks can be stopped before reaching webserver by filtering traffic:
1.
2.
At the IP/TCP level (layers 3-4)
At the application level (layers 5-7)
โ
A network infrastructure solution can be provided for a software security problem
โ
Resources normally dedicated to securing the code can be devoted to other security threats
6. Benefits of a WAF
โ
Simply put,in perfect world proper ,secure application code would be written by developers
to keep their data safe.
โ
But we donโt live in a perfect world.
โ
Therefore compensating controls, like Web Application Firewalls, will continue to be
necessary to protect organizationsโ private data from being exposed.
7. Conclusion
1.
Organization canโt ignore the importance of application code review
2.
Whenever possible ,the root cause of any security problem should be addressed before
compensating controls
3.
Not all organization have the capability to address security flaws at the code level
4.
Even well -coded application may eventually be vulnerable to OS level attacks
5.
โNo one was ever fired for recommending defense-in-depth.โ
