For VendorsBlog

WAF-web application firewall

WAF-web application firewall

A WAF (Web Application Firewall) helps protect web applications by filtering and monitoring HTTP traffic between a web application and the Internet. It typically protects web applications from attacks such as cross-site forgery, cross-site-scripting (XSS), file inclusion, and SQL injection, among others. A WAF is a protocol layer 7 defense (in the OSI model), and is not designed to defend against all types of attacks. This method of attack mitigation is usually part of a suite of tools which together create a holistic defense against a range of attack vectors.

In recent years, web application security has become increasingly important, especially after web application attacks ranked as the most common reason for breaches, as reported in the Verizon Data Breach Investigations Report. WAFs have become a critical component of web application security, and guard against web application vulnerabilities while providing the ability to customize the security rules for each application. As WAF is inline with traffic, some functions are conveniently implemented by a load balancer.

According to the PCI Security Standards Council, WAFs function as “a security policy enforcement point positioned between a web application and the client endpoint. This functionality can be implemented in software or hardware, running in an appliance device, or in a typical server running a common operating system. It may be a stand-alone device or integrated into other network components.”

By deploying a WAF firewall in front of a web application, a shield is placed between the web application and the Internet. While a proxy server protects a client machine’s identity by using an intermediary, a web firewall is a type of reverse-proxy, protecting the server from exposure by having clients pass through the WAF before reaching the server.

A WAF operates through a set of rules often called policies. These policies aim to protect against vulnerabilities in the application by filtering out malicious traffic. The value of a WAF management comes in part from the speed and ease with which policy modification can be implemented, allowing for faster response to varying attack vectors; during a DDoS attack, rate limiting can be quickly implemented by modifying WAF policies.

WAF solutions can be deployed in several ways—it all depends on where your applications are deployed, the services needed, how you want to manage it, and the level of architectural flexibility and performance you require. Do you want to manage it yourself, or do you want to outsource that management? Is it a better model to have a cloud WAF service, option or do you want your WAF to sit on-premises?

A WAF products can be implemented one of three different ways:

  • A network-based WAF is generally hardware-based. Since they are installed locally they minimize latency, but network-based WAFs are the most expensive option and also require the storage and maintenance of physical equipment.
  • A host-based WAF may be fully integrated into an application’s software. This solution is less expensive than a network-based WAF and offers more customizability. The downside of a host-based WAF is the consumption of local server resources, implementation complexity, and maintenance costs. These components typically require engineering time, and may be costly.
  • Cloud-based WAFs offer an affordable option that is very easy to implement; they usually offer a turnkey installation that is as simple as a change in DNS to redirect traffic. Cloud-based WAFs also have a minimal upfront cost, as users pay monthly or annually for security as a service. Cloud-based WAFs can also offer a solution that is consistently updated to protect against the newest threats without any additional work or cost on the user’s end. The drawback of a cloud-based WAF is that users hand over the responsibility to a third-party, therefore some features of the WAF may be a black box to them.

 

 

 

The most popular products in category WAF-web application firewall All category products

Citrix ADC (Application Delivery Controller)
15
19
Imperva Web Application Firewall
20
18
Barracuda Web Application Firewall
9
6
Barracuda WAF-as-a-Service
14
17
Fortinet FortiWeb: Web Application Firewall (WAF)
7
12
AWS WAF - Web Application Firewall
0
10
Citrix NetScaler
3
20
PT Application Firewall
15
8
Imperva Incapsula
4
1
F5 Silverline Web Application Firewall
19
19
F5 Big-IP Application Security Manager
5
5
Sophos Web Gateway
13
10

Compare of products in the category WAF-web application firewall

Please turn the screen for optimal content display

Compare: WAF - Web Application Firewall

Characteristics

SSL Transactions/Second

Platform Throughput

Ports

Height

SQL Injection Attacks

Cross-Site Scripting Attacks

Cookie Tampering

Form Validation and Protection

HTTP and XML Reply and Request format validation

JSON payload inspection

Signature and Behavior based protections

Data Loss Prevention (DLP) support

XML Denial of Service protection

Authentication, authorization and auditing support

Support for SSL offloading

Reporting and Policy tools that provide for easier PCI-DSS compliance verification

IP Reputation Database

Support for LDAP, RADIUS, Local, SAML 2.0

HIPPA compliance verification

Layer 7 Denial of Service protection

Layer 4 Denial of Service protection

Session Hijacking

SOX or BASEL II compliance verification

Virtual Patching

Integration with Sandbox

Authentication support NTLM and Kerberos

Additional Protection for SMTP and FTP attacks (SPAM, Antivirus, Harvesting, Fraud)

DoS/DDoS protection/Botnet Protection

Stateful Firewall

SOAP, HTML5 sockets, Web 2.0 Protections

3rd Party Vulnerability Integrations

NSS Labs Recommended

N/A
N/A
N/A
N/A
2500
1500
N/A
N/A
N/A
N/A
2000
N/A
2230
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
25 Mbps
5000 Mbps
N/A
N/A
N/A
N/A
5000 Mbps
25 Mbps
500 Mbps
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
  • N/A
  • N/A
  • N/A
  • N/A
  • 2x100FE Copper w/Bypass
  • 6xGE (Copper)
  • N/A
  • N/A
  • N/A
  • N/A
  • 8-GE (Copper)
  • Optional SFP
  • 2-10GE SR or LR
  • 4-GE(Copper)
  • 4-1GE (Copper)
  • N/A
  • N/A
  • N/A
  • N/A
  • N/A
  • N/A
  • N/A
  • N/A
  • N/A
  • N/A
  • N/A
  • N/A
  • N/A
  • N/A
N/A
N/A
N/A
N/A
1U (mini)
1U
N/A
N/A
N/A
N/A
1U
1U (desktop)
1U
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
Found mistake? Write us.

Suppliers WAF-web application firewall

Cisco
AUT...
  • AUT
  • AUS
  • BRA
  • CAN
  • CHN
  • DEU
  • ESP
  • FRA
  • GBR
  • HUN
  • MEX
  • NOR
  • POL
  • SGP
  • UKR
  • USA
Citrix
ARE...
  • ARE
  • ARG
  • AUT
  • AUS
  • BEL
  • BRA
  • CAN
  • CHL
  • CHN
  • COL
  • CZE
  • DEU
  • DNK
  • ESP
  • FIN
  • FRA
  • GBR
  • GRC
  • IDN
  • IRL
  • IND
  • ITA
  • JPN
  • KOR
  • LUX
  • MEX
  • MYS
  • NLD
  • NOR
  • PHL
  • POL
  • SWE
  • SGP
  • THA
  • TUR
  • USA
  • ZAF
Softprom (supplier)
ARM...
  • ARM
  • AUT
  • GEO
  • KAZ
  • MDA
  • UKR
Akamai Technologies
ARE...
  • ARE
  • ARG
  • AUS
  • BRA
  • CAN
  • CHE
  • CHL
  • CHN
  • CRI
  • CZE
  • DEU
  • DNK
  • ESP
  • FRA
  • GBR
  • IRL
  • ISR
  • IND
  • ITA
  • JPN
  • KOR
  • MEX
  • MYS
  • NLD
  • POL
  • SWE
  • SGP
  • TWN
  • USA
Cloudflare
AUS...
  • AUS
  • BEL
  • CHN
  • DEU
  • FRA
  • GBR
  • JPN
  • PRT
  • SGP
  • USA
ANYSOFT
UKR...
  • UKR
  • USA
AlgoSec
AUS...
  • AUS
  • DEU
  • FRA
  • GBR
  • ISR
  • IND
  • SGP
  • USA
Cequence Security
AUT...
  • AUT
  • CHE
  • DEU
  • FRA
  • GBR
  • IND
  • USA

Vendors WAF-web application firewall

Cisco
AUT...
  • AUT
  • AUS
  • BRA
  • CAN
  • CHN
  • DEU
  • ESP
  • FRA
  • GBR
  • HUN
  • MEX
  • NOR
  • POL
  • SGP
  • UKR
  • USA
Citrix
ARE...
  • ARE
  • ARG
  • AUT
  • AUS
  • BEL
  • BRA
  • CAN
  • CHL
  • CHN
  • COL
  • CZE
  • DEU
  • DNK
  • ESP
  • FIN
  • FRA
  • GBR
  • GRC
  • IDN
  • IRL
  • IND
  • ITA
  • JPN
  • KOR
  • LUX
  • MEX
  • MYS
  • NLD
  • NOR
  • PHL
  • POL
  • SWE
  • SGP
  • THA
  • TUR
  • USA
  • ZAF
Barracuda Networks
AUT...
  • AUT
  • AUS
  • BEL
  • CAN
  • CHE
  • CHN
  • DEU
  • FRA
  • GBR
  • IRL
  • ISR
  • IND
  • ITA
  • JPN
  • LIE
  • LKA
  • LUX
  • MYS
  • NPL
  • NZL
  • PRT
  • SGP
  • USA
Acunetix
GBR...
  • GBR
  • MLT
  • USA
Akamai Technologies
ARE...
  • ARE
  • ARG
  • AUS
  • BRA
  • CAN
  • CHE
  • CHL
  • CHN
  • CRI
  • CZE
  • DEU
  • DNK
  • ESP
  • FRA
  • GBR
  • IRL
  • ISR
  • IND
  • ITA
  • JPN
  • KOR
  • MEX
  • MYS
  • NLD
  • POL
  • SWE
  • SGP
  • TWN
  • USA
Cloudflare
AUS...
  • AUS
  • BEL
  • CHN
  • DEU
  • FRA
  • GBR
  • JPN
  • PRT
  • SGP
  • USA
AlgoSec
AUS...
  • AUS
  • DEU
  • FRA
  • GBR
  • ISR
  • IND
  • SGP
  • USA
Cequence Security
AUT...
  • AUT
  • CHE
  • DEU
  • FRA
  • GBR
  • IND
  • USA
BullGuard
BEL...
  • BEL
  • DNK
  • GBR
  • ROU

F.A.Q. about WAF-web application firewall

What types of attack WAF prevents?

WAFs can prevent many attacks, including:

  • Cross-site Scripting (XSS) — Attackers inject client-side scripts into web pages viewed by other users.
  • SQL injection — Malicious code is inserted or injected into an web entry field that allows attackers to compromise the application and underlying systems.
  • Cookie poisoning — Modification of a cookie to gain unauthorized information about the user for purposes such as identity theft.
  • Unvalidated input — Attackers tamper with HTTP request (including the url, headers and form fields) to bypass the site’s security mechanisms.
  • Layer 7 DoS — An HTTP flood attack that utilizes valid requests in typical URL data retrievals.
  • Web scraping — Data scraping used for extracting data from websites.

What are some WAFs Benefits?

Web app firewall prevents attacks that try to take advantage of the vulnerabilities in web-based applications. The vulnerabilities are common in legacy applications or applications with poor coding or designs. WAFs handle the code deficiencies with custom rules or policies.

Intelligent WAFs provide real-time insights into application traffic, performance, security and threat landscape. This visibility gives administrators the flexibility to respond to the most sophisticated attacks on protected applications.

When the Open Web Application Security Project identifies the OWASP top vulnerabilities, WAFs allow administrators to create custom security rules to combat the list of potential attack methods. An intelligent WAF analyzes the security rules matching a particular transaction and provides a real-time view as attack patterns evolve. Based on this intelligence, the WAF can reduce false positives.

What is the difference between a firewall and a Web Application Firewall?

A traditional firewall protects the flow of information between servers while a web application firewall is able to filter traffic for a specific web application. Network firewalls and web application firewalls are complementary and can work together.

Traditional security methods include network firewalls, intrusion detection systems (IDS) and intrusion prevention systems (IPS). They are effective at blocking bad L3-L4 traffic at the perimeter on the lower end (L3-L4) of the Open Systems Interconnection (OSI) model. Traditional firewalls cannot detect attacks in web applications because they do not understand Hypertext Transfer Protocol (HTTP) which occurs at layer 7 of the OSI model. They also only allow the port that sends and receives requested web pages from an HTTP server to be open or closed. This is why web application firewalls are effective for preventing attacks like SQL injections, session hijacking and Cross-Site Scripting (XSS).