AWS WAF: Overview
What is AWS WAF?
AWS WAF, a widely used security tool from Amazon Web Services, is a web application firewall designed to safeguard web application servers against various online threats. The tight integration of AWS WAF with key AWS services, including Amazon CloudFront CDN, Application Load Balancer (ALB), and Amazon API Gateway, ensures a comprehensive security approach. AWS WAF can also protect services offered by other providers as long as the content is delivered via the CloudFront distribution network.
Advantages of AWS WAF
Real-time Visibility
AWS WAF delivers real-time visibility by capturing in-depth information about raw requests, such as IP addresses, geo-locations, URIs, User-Agent, and Referrers. This real-time visibility empowers users with valuable intelligence to enhance their application security.
With its seamless integration into Amazon CloudWatch, AWS WAF offers a simplified approach to custom alarms for exceeding thresholds or identifying specific attacks.
Cost Structure
AWS WAF operates on a complete pay-as-you-go model, where the cost is based on the number of ACLs (Access Control Lists) and rules associated with each ACL. This flexible pricing structure allows control over the cost of AWS WAF as it aligns with the application's specific needs and usage patterns.
It's important to note that while AWS' native security tools may appear cost-effective initially, customers with a significant web presence may find their bills growing considerably due to the need for a greater number of web ACLs and rules to achieve the desired level of granularity.
Table of Content
- AWS WAF: Overview
- AppTrana WAF: Overview
- AWS WAF vs AppTrana Key Differences
- AWS WAF vs AppTrana Feature Comparison Table
AppTrana WAF: Overview
What is AppTrana WAF?
AppTrana WAF is an advanced web application security solution from Indusface that offers comprehensive protection against cyber threats. With features such as customizable rules, bot protection, DDoS mitigation, real-time monitoring, and security analytics, AppTrana WAF ensures the security of web applications.
It effectively detects and mitigates OWASP Top 10 vulnerabilities, SQL injection, XSS, CSRF, and other malicious activities while defending against automated bot attacks and DDoS incidents.
Advantages of AppTrana WAF
Bundled DAST Scanner and Penetration Testing
AppTrana is the only WAAP provider to integrate a DAST scanner and penetration testing executed by certified security researchers.
This combined approach enables a comprehensive view of your web application's security posture, combining automated scanning with manual testing to uncover vulnerabilities and provide actionable insights for remediation.
Detection and Blocking
AppTrana maintains a 100% block mode deployment for applications. Unlike other WAFs that often operate in log-only mode, leaving analysis for after an attack has occurred, AppTrana prioritizes proactive protection. With managed services and rigorous false-positive testing, AppTrana remains in block mode and actively blocks malicious requests.
Advantages of AppTrana WAF over AWS WAF
Advantages of AppTrana WAF over AWS WAF
DDoS Protection
AppTrana's DDoS mitigation solution effectively manages high-volume attacks through its inbuilt, unmetered, and always-on DDoS scrubber. One of the key differentiators of AppTrana is its adaptive approach. AppTrana dynamically learns traffic patterns and behaviour, continuously updating its rate limit thresholds. With this proactive optimization, AppTrana detects and blocks attacks within seconds without manual intervention
Additionally, AppTrana ensures unmatched control with its pioneering URI-based DDoS protection, setting new industry standards. This feature allows to block or apply additional in-depth filtering at various URIs such as login pages, checkout flows, sign-up procedures, and pricing pages.
To acquire DDoS mitigation on AWS, one must opt for the AWS Shield Advanced service, with a fee of $3000 per month with a minimum contract duration of 12 months. On the other hand, AppTrana's Advance, Premium, and Enterprise plans offer robust security against DDoS attacks at a significantly reduced price.
API Security
AppTrana offers comprehensive API protection to manage APIs more securely. This includes advanced features like automatic API discovery for monitoring API usage and sensitive data and detecting rogue and shadow APIs.
Furthermore, AppTrana's Premium and Enterprise plans come with API scanning and API pen testing, simplifying the process of identifying API proxies that do not meet security standards.
The API security options on AWS are quite limited, with only basic rate-limiting capabilities accessible through the API gateway. Advanced features such as API discovery are not currently available.
Payload Inspection Size
When it comes to request size inspection, there is a significant difference between AWS WAF and AppTrana. While AWS WAF has a maximum request size limit of 64KB, AppTrana offers payload inspection sizes of up to 134 MB.
AppTrana enables comprehensive analysis of requests by offering a significantly larger payload inspection size, ensuring that no potentially malicious traffic goes unnoticed.
Virtual Patching with Application-Specific Custom Rules
Even for critical and high vulnerabilities, AppTrana WAF offers the flexibility to block attacks without any code changes. With the help of custom rules and application-specific virtual patches, potential threats can be mitigated directly at the WAF level.
Additionally, its embedded DAST scanner identifies vulnerabilities that require immediate attention, and the managed security team will convert them into security rules within 24 hours.
AWS WAF offers users the flexibility to create custom rules or utilize managed rules from third-party vendors like F5, Fortinet, and Trustwave. These vendors offer a collection of predefined rules, allowing AWS WAF users to apply virtual patches effortlessly.
However, subscribing to a managed rule group from an AWS Marketplace seller incurs additional fees separate from the AWS WAF charges.
AppTrana extends its custom rules capabilities to all plans, ensuring that all customers benefit from comprehensive protection.
24/7 Support
Our state of application security report reveals a significant 48% increase in DDoS attacks, with 498 million reported in Q1, 2023, compared to 336 million in Q4, 2022. The rising prevalence of attack trends such as DDoS and bots heightens the importance of maintaining business continuity for web applications and APIs.
In the event of such attacks, the support team plays a crucial role as an extended Security Operations Center (SOC) to mitigate the impact on the services.
It's important to note that AWS WAF does not provide 24x7 support. However, with AppTrana, even customers on the $99 plan can enjoy round-the-clock support through phone, email, and chat. They provide valuable assistance by configuring custom rules, updating blacklisting policies, and implementing other necessary measures to counter the attacks effectively.
Feature Comparison Table: AppTrana WAF vs AWS WAF
| WAF Feature | AppTrana | AWS WAF |
|---|---|---|
Gartner Peer Insights Rating |
4.9 | 4.4 |
Gartner Peer Insights Customer Recommendation Rating |
100% | 90% |
DDoS Monitoring |
Starts at $399 | $3000 per month |
Payload Inspection Size |
134MB | 64KB |
Virtual Patching |
Starts at $99 | -- |
NTLM Support |
Yes | No |
Response Timeout |
Default: 300 seconds Max: 300 seconds |
Default: 30 seconds Max: 300 seconds |
Bot Protection |
Yes | Basic |
DAST Scanner |
Bundled in all plans | Not Available |
Penetration Testing |
Bundled in the $399 plan | Not Available |
EASM (External Attack Surface Management)
|
Bundled in all plans | Not Available |
API Security
|
Available | Basic capabilities through API Gateway |
API discovery
|
Available | Not Available |
API Scanning
|
Bundled in the $399 plan | Not Available |
API Pen Testing
|
Bundled in the $399 plan | Not Available |
Workflow-based bot mitigation
|
Starts at $399 | Not Available |
Managed Services
|
Starts at $399 | Not Available |
24X7 Support
|
Phone, email, and chat support starts at $99 | Not Available |
*Disclaimer - The comparison is based on our research from publicly available information