Web Application Security: WAF

Ruslan Rakhmetov, Security Vision

Fig. 1 - Web Application Firewall (WAF) - protecting web applications

In this article we will consider Web Application Firewall (WAF) solutions. The term itself consists of two parts: Web Application (web application, website) and Firewall (as we have discussed earlier, firewall). In order to understand its main difference from regular firewalls, it is worth understanding the peculiarities of web applications.

The most important difference is that it is available over the network, which means that it provides a convenient and constant service to its users without being bound to the operating system (like mobile applications) and without mobility limitations (like standalone applications). At the same time, it is also a ‘convenient’ entry point for attackers. While in 2014, when Gartner just started releasing analytics on WAF, about 60% of attacks on companies were via web applications, it is now believed that such class solutions are not needed only for those companies that are not sorry to lose web services or simply don't have them.

Another difference is the diversity of functionality: despite the common designation HTTP(S) on top of this web protocol can be an additional add-on (or several), providing a variety of ways of interaction and, consequently, a variety of attack methods. This means that the most effective WAF, as well as solutions like NGFW, should combine several protection modules working in parallel. Every web application protection system includes signature analysis and DDoS protection modules, which we discussed in the last article.

Figure 2 - Technologies within the WAF

The first technology that comes to mind when looking for malicious activity is signature analysis. This technology has long been used by systems of various classes, starting with antivirus on endpoints and server components. In the case of WAF, signature analysis complements the HTTP and over-the-top analysis methods of almost every vendor's solution. Similar to specialised email protection, WAF uses another technology - reputational analysis of individual elements in traffic, which is based on the global operation of the solutions. Together these two modules, although they do not allow to protect against zero-day attacks, but due to constant updates they are able to effectively reject some threats.

The WAF is also supported by a community of experts from each vendor: constant updating of security policies in these solutions is most effective if they are developed by an expert. WAF systems analyse user sessions with a web application in its entirety (with URL and client cookies analysed) in order to detect unknown activity. This makes it possible to detect browser-side fraudulent activity and input form spoofing, protecting the user, not the web application. Experts, when filling policies with new rules, focus on OWASP methodologies and those described in various standards (e.g. PCI DSS). Often, machine learning technologies are used to help experts create new policies.

Machine learning can also profile the customer and predict future load. Ideally, the fault tolerance of the entire web application suite can be improved with the use of load balancers, but separate integrations must be developed to achieve this. Integration tasks are solved either by in-house/customised development or by using low-code tools, e.g. within SOAR platforms. For example, data from a single WAF module can be fed into IT systems and antimalware systems, triggering entire chains of actions to prevent the consequences of an attack.

WAFs can also include modules of SAST, IAST and DAST types. Static source code analysis allows to detect vulnerabilities with the help of the community and get a ready-made solution. ‘Tapping’ the site with secure attacks makes it possible to detect such threats that have not yet been described in the sources. Also, dynamic analysis uses an already compiled application and is not tied to the language in which its code is written. Joint application of scanners exactly within the WAF allows to install a virtual ‘patch’ on the protected service without disconnecting from the current development sprints.

Fig. 3 - WAF location

The solution is usually deployed at the edge of the perimeter, between the protected service and its users outside. This allows for increased protection at the application level, as well as inspection of SSL/TLS traffic. The use of anti-DDos modules and constant updates of security policies via cloud services put WAF solutions in hybrid mode.

Due to the speed requirements, the most effective solutions are those that are delivered as a hardware-software complex - with hardware on which the speed is optimised specifically for WAF algorithms. On the other hand, if there is a small capacity reserve, the system can be deployed on existing services, which is convenient from the point of view of IT support. The system modules themselves can be located either on the perimeter, as an echelon in front of the protected service, or in the cloud.

WAF is a comprehensive solution for protecting web applications, which can include functionalities inherited from antivirus and other types of firewalls (NGFW, UTM or classic firewall). The penetration of SAST/DAST technologies allows not only the use of vendor expertise, but also the release of virtual patches to protect the application from new threats.

However, in some cases, technologies such as site reputation analysis and multi-protocol protection implementations are slightly more effective in IPS or NGFW solutions. Located at the edge of the network, WAF provides the maximum depth of analysis of user activity, protecting the application and sometimes even the customers themselves from potential fraud. Continuous updating of expertise via cloud elements makes the resource effective within a subscription licensing model, as well as when used in a cloud provider.