Firewall vs WAF

Introduction

Understanding what a web application firewall (WAF) is versus a firewall can be confusing, but a simple analogy can clear things up.

Imagine going to a venue for a concert and having to pass through security guards at the main gate who check who is allowed to enter. They’re acting as a firewall – making sure you have a valid ticket and ID and aren’t carrying anything in that could be harmful before allowing you to enter. The bouncers at the stage and security staff at the bar and lounge areas act more like WAFs. They’re checking to make sure you behave properly and aren’t causing any trouble once you’re inside. 

In this blog, we’ll discuss what firewalls and WAFs do, when to use them, how they are different, and if they are complementary. We’ll also explore the types of cyber threats they do a good job defending against, including their role mitigating DDoS attacks. 

What is a Firewall?

A network firewall protects a network boundary by inspecting and filtering malicious traffic that’s attempting to cross that boundary and gain access to a section of a corporate network or exfiltrate sensitive data.

How do Firewalls Operate?

Firewalls operate at the Network Layer (Layer 3) and Transport Layer (Layer 4) of the OSI model. They look at packet headers and allow or block packets based on IP addresses and port numbers. Next-generation firewalls include additional functionality to also inspect payloads of packets to look for malware infiltrating the network, data leaving the network, and other threats.

Firewalls require considerable setup and ongoing tuning to ensure organizations are getting the right protection and aren’t erroneously blocking good traffic and slowing down business operations. Over time, configuration drift is also a risk, leading to potential vulnerabilities.  

What do Firewalls Protect Against?

Firewalls protect network traffic and data transfer. Their primary role is to:

• Control incoming and outgoing network traffic based on security policies.
• Act in a stateful manner, meaning monitor active connections and determine the legitimacy of network packets based on IP addresses and protocol states.
• Offer protection against unauthorized access and certain types of malicious traffic, such as attacks against the Domain Name System (DNS) and Transmission Control Protocol (TCP). They also provide some basic protection against certain types of DDoS attacks such as ICMP floods and IP fragmentation

What is a WAF?

A WAF is designed to protect web applications, application programming interfaces (APIs), and web servers by filtering and monitoring HTTP/S traffic between web services and end users.

How do WAFs Operate?

WAFs operate at the Application Layer (Layer 7) of the OSI model. They look at HTTP/S requests to access internet-facing services and use a variety of techniques to filter, monitor, and block any malicious incoming HTTP/S traffic while also preventing sensitive data from leaving the application without authorization.

Like firewalls, WAFs also require extensive customization and oversight to ensure optimized performance. As hybrid cloud environments become increasingly complex, challenges to managing operational sprawl mount.

What do WAFs Protect Against?

The primary role of a WAF is to shield web applications from various application layer threats, including:

• Cross-site scripting (XSS), where hackers inject malicious scripts into web pages viewed by users.
• SQL Injection, when attackers exploit vulnerabilities in an application to inject malicious SQL code.
• Basic protection against some Layer 7 DDoS attacks.
• Data leakage, including stealing credentials.

Do You Need Both a Firewall and a WAF?

Firewalls have been around much longer than WAFs and are a fundamental layer of network protection in the security stack. Next-generation firewalls emerged to add more capabilities including some protection for web applications, which can add to the confusion around whether you need a firewall and WAF.

However, as cloud-based platforms and web applications proliferate and enable essential revenue-generating activities for many organizations, security teams often add a WAF. Dedicated to protecting web application traffic, WAFs are purpose-built to further strengthen security posture against attacks that target web services.

Firewalls, WAFs, and DDoS Attacks

Despite sharing the “firewall” moniker, firewalls and WAFs coexist as common security layers for most organizations because they don’t protect against the same types of attacks. Instead, firewalls are focused on protecting the network from unauthorized access and malicious activity that occurs at Layers 3 and 4, and WAFs are focused on protecting web applications from malicious activity that occurs at Layer 7.

Firewalls and WAFs can help detect and block behavior that may contribute to a DDoS attack at the layers they focus on respectively. However, they are not designed to handle the volumetric and multi-vector DDoS attacks that now occur via different points of entry.

Organizations face an average of 11 DDoS attacks per day, and they aren’t just targeting Layers 3 and 4. Attacks against Layer 7 are now standard in threat actors’ playbooks. An alternative approach—Corero’s SmartWall ONE™ with CORE—provides meaningful web application protection for real-world threats alongside full spectrum DDoS protection. With less manual work and no operational sprawl, it’s also more cost-effective.

Firewall vs WAF vs SmartWall ONE with CORE: Differences

Just as security guards at the main entrance of a concert venue versus bouncers at the stage and lounge areas, firewalls and WAFs cover two distinct areas of an organization’s infrastructure and have different objectives. And yet, without sprinklers in the building, you’re still in danger if a fire breaks out. That’s where Corero comes in. The following table summarizes some of the key differences.