How do Web Application Firewalls Work?

Introduction

In a prior blog, we described firewalls as being similar to the security guards at the main gate at a concert venue and WAFs acting like bouncers at the stage, making sure you aren’t causing any trouble once you’re inside. 

In this blog, we take a closer look at WAFs, including how they operate, their benefits, and their limitations. We also review the types of attacks they protect against and discuss a modern alternative to WAFs to consider.

What is a WAF?

A WAF is designed to protect web applications, application programming interfaces (APIs), and web servers by monitoring and filtering HTTP/S traffic between web services and end users.

How do WAFs Operate?

WAFs operate at the Application Layer (Layer 7) of the OSI model. By deploying a WAF in front of a web application, they act as a guard between the web application and the internet. They look at HTTP/S requests to access internet-facing services and use a variety of techniques to filter, monitor, and block any malicious incoming HTTP/S traffic while also preventing sensitive data from leaving the application without authorization.

A WAF operates through a set of rules or policies. These policies aim to protect against vulnerabilities in the application by filtering out malicious traffic. WAFs may use a variety of approaches to allow administrators to create policies that analyze and filter content contained in HTTP requests. 

• Allowlists explicitly define allowed traffic patterns and behaviors and permit only known, preapproved traffic and reject all other patterns.
• Blocklistsdeny access based on traffic that matches predefined malicious attack patterns or signatures.
• Hybrid approaches utilize both allowlists and blocklists.
• Advanced capabilities incorporate machine learning, AI algorithms, and threat intelligence to proactively defend against emerging threats that deviate from known attack patterns.

What do WAFs Protect Against?

The primary role of a WAF is to shield web applications from various application layer threats, including:

• Cross-site scripting (XSS), where hackers inject malicious scripts into web pages viewed by users.
• SQL Injection, when attackers exploit vulnerabilities in an application to inject malicious SQL code.
• Basic protection against some Layer 7 DDoS attacks.
• Data leakage, including stealing credentials.

What are the Different WAF Deployment Models?

WAFs can be deployed in networking environments as an appliance, a service, as software or a combination.

• Network-based WAFs are usually appliances installed on-prem to minimize latency. Their biggest drawback is their cost – both the initial capital expenditure and ongoing resources required to manage storage and maintain physical equipment.
• Cloud-based WAFs offer a turnkey option that allows for fast deployment, minimal up-front costs, and a predictable monthly subscription fee. One challenge is that it can be difficult to entrust a third party with filtering web application traffic. On the plus side, protection can be quickly replicated across many locations and capabilities are more likely to include real-time threat intelligence to improve detection of malicious activity.
• Software-based, or host-based, WAFs are deployed as a virtual appliance or agent in a public cloud, in a private cloud, or on-premises. Host-based WAFs are typically less expensive to operate than network-based WAFs and allow more customization than cloud-based WAF solutions.
• Hybrid deployment models that include both on-prem and cloud-based options provide a combination of control and scalability but also introduce complexity in managing both components.

Benefits of WAFs

As cloud-based platforms and web applications proliferate, WAFs have been introduced to strengthen security posture and offer the following benefits.

• Protect ecommerce activities: For organizations that leverage their online presence for revenue-generating activities, a WAF helps to prevent attacks designed to gain unauthorized access to IT environments or to steal confidential customer records and sensitive data such as credit card numbers.
• Enable regulatory compliance: Banks, retailers, and other organizations that accept payment cards can use a WAF to help address compliance with the Payment Card Industry Data Security Standard (PCI DSS).
• Secure modern devices: Organizations may also use WAFs to secure mobile applications and protect Internet of Things (IoT) networks.

Limitations of WAFs

Despite their benefits, WAFs also come with limitations.

• Cost: Many WAFs require extensive customization, and ongoing oversight and tuning to ensure optimized performance.
• Complexity: The operational burden increases as hybrid cloud environments become increasingly complex, and organizations implement multiple WAFs each with their own dashboards.
• Alert fatigue: WAFs typically require a large number of policies that leverage blocklists and allowlists which may be prone to significant false positives that can cause alert fatigue.
• Ineffective against complex attacks: WAFs operate at Layer 7 which limits their effectiveness against volumetric and multi-vector DDoS attacks that now occur via multiple different points of entry.

A Smart Alternative to WAFs

Organizations face an average of 11 DDoS attacks per day, and those attacks are targeting multiple layers of the OSI model – Layers 3, 4, and 7. WAFs are focused on protecting web applications from malicious activity and can help detect and block behavior that may contribute to a DDoS attack at Layer 7. However, they are not designed to handle modern DDoS attacks that require protection at multiple points of entry.

An alternative approach—Corero’s SmartWall ONE™ with CORE—provides meaningful web application protection for real-world threats alongside full spectrum DDoS protection. With less manual work and no operational sprawl, it’s also more cost-effective.

The following table summarizes some of the key differences between a WAF and Corero’s SmartWall One with CORE.