WAF or a Web Application Firewall is an essential security tool/ product that allows you to proactively protect your websites/ web applications from malicious attacks and maintain a strong defense against bad actors/ traffic. Web App Firewalls protect against known threats such as SQL injection, DDoS attacks, Cross-Site Forgery, Cross-Site Scripting (XSS), file inclusion and clickjacking, among others.
Building and deploying WAFs in today’s modern IT environments, increasingly complex applications with several moving parts and third-party components is a critical-yet-tough process. Here is a guide to help you navigate this process.
The Web Application Firewall is a transparent reverse proxy in front of the application to ensure that all traffic passes through it and separately sends filtered traffic to the application, hiding the IP address of the application service. It essentially monitors and parses all requests based on the rules (called policies) before they reach your web server/ application. These policies equip the Web App Firewall to ensure that malicious requests and payload do not degrade, compromise or expose your applications to DDoS or other threats, or cause an exfiltration of data. The policies tell the firewall what needs to be done if vulnerabilities or misconfigurations are found.
Planning is the crucial first step in building a Firewall. Understand and analyze app-related engineering concerns, your unique context and specialized needs from web app security. Remember that traditional/ legacy approaches to web security and a one-size-fits-all open-source Web App Firewall do not make the cut, given the increasing complexity and dynamism of today’s world. So, it is crucial to understand what your objectives are, where the WAF sits in your security solution and accordingly, tailor security.
Based on your needs, context and budgetary constraints, you must decide how your Firewall will be deployed – as hardware, software or as a cloud WAF. Each of these modes of deployment has its own unique benefits and weaknesses. However, cloud WAF is widely preferred by organizations and security experts owing to its cost-effectiveness, easy deployment, scalability, and agility.
Another important decision is whether you want to build the WAF yourself or onboard it on a comprehensive and intelligent solution like the ones provided by AppTrana. In either case, you will have to go through the following steps.
There are 3 security models that Web App Firewall follows –
Blacklist/ Negative model which allows all traffic while monitoring and preventing/ blocking all known threats and malicious requests. It requires the WAF to continuously engage in behavioral learning, else, the model becomes ineffective.
Whitelist/ Positive model wherein all expect pre-approved requests/ traffic are blocked. It could lead to high false positives (legitimate requests being denied) which is detrimental and so, regular and continuous tuning and configurations are indispensable for this model to be effective.
The hybrid security model combines the positive and negative models to minimize the drawbacks of both and heighten web app security.
You must choose the right model for your context and needs.
The model the WAF provides is just the starting point for deployment and given the dynamic nature of Web applications a hybrid security model is/should be the starting for any serious transactional web applications and after it is deployed how you configure it is when you start getting real value from WAF.
In the next step, you need to lay down all necessary policies, starting with the basic policies first – analyzing traffic, understanding patterns and MO of OWASP and other known vulnerabilities, action on uncovering vulnerabilities, etc. If you are onboarding to a service, the Web App Firewall will already have default policies.
Once the basic policies are laid down, you must configure and tune these policies and create custom policies in line with your context and needs identified in the planning stage. For instance, if you do not serve in specific countries or continents, you can block those geographies from accessing your application/ website. Similarly, there could be flaws arising from business logic/ policy changes. So, the WAF policies need to be tuned continuously.
You must also enable logging and security analytics in the WAF so that security experts can closely monitor and manage security. It is crucial as there exist flaws that go unnoticed by machines and only a human expert can catch and rectify.
Most importantly try to keep the WAF policies updated to provide defenses against existing application security risk that you may uncover with Web application security assessments and build on those policies and attacks as a foundation for creating future application-specific updates on your WAF.
By continuously trying WAF policy updates based on existing risks you uncover in your application from security testing feeds and also understanding of the attacks happening on your website, you can make the Web App Firewall more effective. It will continuously learn from past attack history and global threat intelligence and mapping it to your existing application security risks will enable you to minimize your risks more accurately. AppTrana’s WAF, equipped with providing application context-specific updates by integrating application security risk assessment and managed custom rules/updates to your WAF policies.
Your Web Application Firewall is only as effective as the rules and models you choose. Being updated on the latest happening and best practices on the security front will enable you to tune your WAF and your security solution better.
Ashish Pradhan is responsible for all technology functions like engineering, client services and customer support at Indusface. Prior to joining Indusface, Ashish held various senior leadership roles at Symantec Corporation in India and USA. During his 25 years of global experience in the software industry, Ashish has helped create and grow a broad variety of software products spanning systems management, IT compliance, and information security domains.