7 WAF Security Capabilities and WAF Rules Deep-Dive

• Injection attacks: Prevents attackers from manipulating application queries to access or alter databases.
• Cross-site scripting (XSS): Stops malicious scripts from being injected into web pages viewed by other users.
• Cross-site request forgery (CSRF): Helps validate request authenticity and block unauthorized actions performed through a victim's authenticated session.

• File inclusion attacks: Prevents attackers from loading unauthorized local or remote files that could expose sensitive data or execute malicious code.
• Distributed denial of service (DDoS): Mitigates volumetric attacks or targeted HTTP floods aimed at crashing your servers.
• Server-side request forgery (SSRF): Detects and blocks attempts to force applications to access internal systems, cloud metadata services, or unauthorized external resources.

• The Evolution of WAF Technologies
• The Core Functionality of a WAF
• WAF Deployment Options and Advanced Features
• Deep Dive Into WAF Rules

• Key Security Threats Addressed by WAFs
• WAFs vs. Other Security Tools
• Best Practices for Deploying WAFs Effectively
• WAF Security with Radware

1. Monitoring and Analyzing HTTP/HTTPS Traffic

WAFs continuously monitor HTTP and HTTPS requests to web applications, analyzing them for malicious activity. By examining incoming data, they can quickly detect anomalies that suggest an attack, such as SQL injection attempts or cross-site scripting efforts. This real-time inspection allows for prompt responses to potential threats.

The analysis process involves evaluating the syntax and semantics of requests. WAFs inspect headers, cookies, and other elements to ensure they adhere to established security policies. These measures help identify and block suspected malicious traffic before it can cause harm.

2. Blocking Malicious Requests Based on Predefined Rules

WAFs can block malicious requests through predefined rules. These rules are regularly updated to adapt to emerging threats, and can be customized to match an organization’s specific applications and business rules. They use pattern matching to identify and stop requests that resemble known attack vectors, such as malicious payloads in SQL queries or script tags in input fields.

By leveraging these rules, WAFs can distinguish between legitimate user requests and potential attacks. The blocking mechanism operates without affecting the user experience, ensuring that only harmful requests are filtered out.

WAFs filter and inspect inputs to web applications, ensuring that they do not pose a threat. They sanitize inputs to remove unwanted characters or patterns that may be used in attacks, such as SQL injection or cross-site scripting. This process helps in maintaining the application’s security posture by neutralizing malicious inputs before they can execute.

The sanitization process involves parsing inputs for threats and enforcing rules that prevent harmful data from reaching underlying databases or systems.

4. Negative vs. Positive Security Rules

Negative and positive security models are two approaches WAFs use to define and enforce security rules.

Negative security rules focus on identifying and blocking known threats. These rules match patterns of malicious behavior, such as payloads, signatures, or request anomalies. For example, they might block requests containing known SQL injection patterns or script tags. While effective against known attack vectors, negative rules require constant updates to keep up with evolving threats.

Positive security rules define what is explicitly allowed and block everything else. This approach is stricter, ensuring that only legitimate traffic, conforming to predefined criteria, reaches the application. For example, if an input field is only supposed to accept numeric values, a positive rule would block any non-numeric input. While highly secure, this model requires detailed knowledge of application behavior and can be challenging to implement and maintain in dynamic environments.

A well-configured WAF often combines both models to strike a balance between broad threat coverage and strict access control.

5. Inline vs. Out of Path (OOP)

WAFs can be deployed in inline or out-of-path (OOP) configurations.

In an inline deployment, the WAF is placed directly in the traffic path between users and the application. This allows it to inspect and block requests in real time. Inline WAFs offer immediate protection but can introduce latency and become a single point of failure if not properly managed.

In an out-of-path deployment, the WAF operates alongside the traffic flow, receiving mirrored traffic for analysis. Instead of blocking malicious requests directly, it alerts the application or network administrators. This approach minimizes latency and avoids disrupting legitimate traffic, but it requires additional mechanisms to act on detected threats.

6. Behavioral Detection

Behavioral detection in WAFs leverages application learning to build a detailed profile of an application’s normal behavior. This involves analyzing parameters such as HTTP methods, form field values, cookies, and other user interactions to create a baseline for what constitutes typical application usage. By comparing incoming traffic to this baseline, a behavior-based WAF can detect and respond to anomalies that may signal an attack.

For example, if an input field typically accepts numeric values within a defined range, and a user attempts to input text or values outside that range, the WAF can flag this as suspicious. Over time, as the WAF gathers more data, its profile becomes more accurate, reducing the chances of false positives.

7. AI-Driven Detection

Machine learning-powered WAFs analyze vast amounts of traffic data to classify behavior as either legitimate or malicious. They use probabilistic models to assess the likelihood of a security threat, which helps in reducing false positives compared to traditional rule-based or behavior-based approaches. Over time, these systems improve in accuracy, requiring minimal human intervention.

Deep learning, a subset of machine learning, takes this further by processing data in new ways. For example, one approach is to transform HTTP request packets into image-like formats for analysis. Convolutional neural networks (CNNs) can analyze these images to detect patterns indicative of web attacks. This allows for the detection of threats that may bypass conventional systems.

Fundamental (Pre-defined) WAF Rules

Each WAF comes with a basic set of rules out of the box. In most cases these rules are based on certain blocklists as per known signatures, bad reputation IP lists, etc.

The better the WAF, the broader and more robust, and more relevant the pre-defined ruleset would be to answer to the most current cyber security threats. Although these rules are pre-defined, WAF vendors must constantly and continuously update them to ensure their customers are protected against the very latest threats.

Advanced WAF Rules

Advanced WAFs allow analysts, security experts, and other users to define advanced rules with granular customization options to improve their applications' security and performance and reduce network load on application servers.

Here are some examples of custom rules:

• Block access to specific sections of a website based on IP address or Headers
• Prevent search engine bots from accessing a website
• Redirect traffic to a maintenance page
• Add an additional header to specific requests
• Change the value of a header to another value

WAF Rule Structure

Rules usually consisted of rule metadata, a set of conditions, and an action.

Metadata

For each rule, you can set a rule name and a rule description. The rule metadata information is used to describe the rule and is also presented as part of the security event that is generated when a rule is triggered. You can also set the rule state to be enabled or disabled.

Conditions

Conditions are used to trigger the rule by matching a condition to the content of the request. For each rule, you can set multiple conditions.

Action

An action will take place in case the requests matched the conditions described in the conditions section of the rule. The available actions are independent of the rule type that is selected.

Rules are usually arranged according to their action type into four major groups:

Priority

In most industry-standard WAFs HTTP/S Requests are matched against rules according to a predefined priority. For instance, Redirect Rules → Security Rules → Rewrite Rules and within each group, you can set the internal priority of existing rules within that group.

Real-life Examples of WAF Rules

Let's see some examples of rules provided as part of the Radware WAF solution. Some of these rules are automatically generated by Radware's machine-learning algorithms and the Radware data lake, some are updated by Radware's team of cyber experts at the backend, and some are generated by Radware's ERT Active Attackers Feed (e.g., Radware's global intelligence, honey pots, and deception networking, device fingerprinting, etc.)

These rules are dynamic and constantly adapt to protect against the most recent threats. Here are a few types of predefined WAF rules:

• OWASP Top 10
• Known CVEs ( on top of the OWASP list)
• Bot mitigation rules
• RFC violations
• Anonymous proxy blocking
• Signature-based protection
• SQL injection protection
• DDoS protection
• Jason validation protection

In addition, Radware provides an advanced interface for defining custom WAF rules including:

• Redirect rules: Used for changing headers to redirect traffic to another location when conditions are met
• Security & Access Control rules: Used for blocking or allowing traffic when conditions are met. Within this group of rules, you would find Geo blocking and security bypass rules
• Rate limiting Rules: Used for controlling traffic volumes as per set thresholds
• Response Delivery rules: Used for modifying (Remove, Rewrite, Insert) the headers of the server responses when the conditions of rules are met.
• API protection rules: Used for setting request quotas from specific API endpoints or blocking them altogether, as well as setting specific API conditions to be met such as type, header, body, path, parameters, etc.
• Bot management rules: Used for configuring which action to be taken if a malicious bot was detected, according to the type of bot that was identified

Injection Attacks

WAFs offer protection against injection attacks, which involve injecting malicious code into an application through input fields or URL parameters. These attacks exploit vulnerabilities to execute unauthorized commands. By inspecting inputs for patterns commonly associated with injections, such as SQL commands, WAFs block these attempts before they reach the application database.

Injection attacks are a prevalent risk due to their potential impact, including data theft and alteration. WAFs utilize multiple detection techniques, including signature-based and behavioral analysis, to identify and mitigate such threats. They act as gatekeepers, preventing unauthorized data manipulation.

Cross-Site Scripting (XSS)

Cross-site scripting (XSS) attacks target vulnerabilities in web applications to execute malicious scripts in a user's browser. WAFs help protect against XSS by analyzing and filtering out suspicious script tags and data input patterns that may lead to execution in a user's context.

WAFs deploy strategies like input sanitization, encoding, and content security policy enforcement to thwart XSS attempts. By intercepting these malicious scripts, WAFs ensure that only safe content is delivered to users.

Cross-Site Request Forgery (CSRF)

Cross-site request forgery (CSRF) involves tricking a user into performing unwanted actions on a web application in which they are authenticated. WAFs combat CSRF by validating requests to ensure they are legitimately initiated by users. Techniques such as token validation and referer header checks are implemented to determine request authenticity.

By verifying requests with unique tokens, WAFs prevent attackers from executing unauthorized actions in a user's context. This validation ensures that interactions with web applications are securely authenticated.

File Inclusion Attacks

File inclusion attacks occur when a web application improperly handles file paths, allowing attackers to include unauthorized files. WAFs prevent these attacks by analyzing file paths and blocking requests that attempt to access sensitive or unauthorized files.

By monitoring request paths and inspecting input fields associated with file operations, WAFs can intercept attempts to access restricted directories. This prevents the execution of malicious code included in unauthorized files.

Distributed Denial of Service (DDoS)

WAFs play a role in mitigating distributed denial of service (DDoS) attacks, which aim to overwhelm a web application with excessive traffic. While not a substitute for dedicated DDoS protection systems, WAFs improve defenses by identifying and filtering abnormal traffic patterns indicative of such attacks.

Many DDoS attacks target application resources, making them unavailable to legitimate users. By differentiating between malicious and normal traffic, WAFs can throttle requests when unusual spikes are detected.

Server-Side Request Forgery (SSRF)

Server-side request forgery (SSRF) attacks exploit a server's capability to send HTTP requests, tricking it into accessing internal or unauthorized resources. Attackers may leverage SSRF to access sensitive data, escalate privileges, or pivot within a network.

WAFs mitigate SSRF by analyzing outgoing requests generated by the server. They enforce rules to validate the destination of these requests, preventing unauthorized access to internal endpoints or third-party services. WAFs also block requests containing suspicious payloads, such as malformed URLs or unexpected headers, that signal potential SSRF attempts.

WAFs vs. Traditional Firewalls

Traditional firewalls filter traffic based on IP addresses, port numbers, and protocols, focusing primarily on network-level threats. WAFs concentrate on application-layer protection, scrutinizing the content of data packets to guard against web vulnerabilities like SQL injections and XSS attacks. This focus makes WAFs more suitable for protecting web applications.

By targeting different layers, WAFs and traditional firewalls complement each other, providing a more comprehensive security posture. While traditional firewalls protect the network perimeter, WAFs address the nuanced threats targeting application logic and user data.

WAFs vs. Next-Generation Firewalls

Next-generation firewalls (NGFWs) extend the capabilities of traditional firewalls by incorporating features like deep packet inspection and intrusion prevention. While NGFWs focus on broader threat landscapes, WAFs specialize in detailed application-level protection. They scrutinize HTTP/HTTPS traffic with more granularity, tailoring defenses to web application threats.

The specialization of WAFs in application-layer security complements the broader functions of NGFWs. WAFs provide focused protection against intricate web attacks while NGFWs target network attacks and other advanced threats.

WAFs vs. Intrusion Prevention Systems

Intrusion prevention systems (IPS) detect and block malicious activities primarily at the network level by analyzing traffic patterns and signatures. WAFs apply their protection mechanisms directly to web applications by understanding application-specific traffic and logic structures. This makes WAFs particularly adept at defending against application-specific intrusions.

WAFs operate at a deeper, more granular level of application traffic, making them indispensable for securing web applications. IPS and WAFs can work in tandem to provide layered security.

Learn more in our detailed guide to WAF vs. IPS

WAF vs. WAAP

While web application firewalls (WAFs) focus on filtering, monitoring, and blocking web application attacks at the HTTP/HTTPS layer, web application and API protection (WAAP) extends this scope to cover API-specific threats. APIs are increasingly targeted due to their role in modern web applications, requiring security mechanisms beyond traditional WAF capabilities.

WAAP solutions integrate application-layer protections with API-specific features like schema validation, rate limiting, and OAuth enforcement. Unlike WAFs, WAAPs are tailored to protect microservices architectures and defend against API abuse. While a WAF may block malicious HTTP traffic, WAAP ensures API endpoints are secure against exploitation.

Application security posture management (ASPM) tools focus on identifying and managing vulnerabilities in an application's development and deployment lifecycle. Unlike WAFs, which operate at runtime to block active threats, ASPM aims to improve security by identifying weaknesses during the build and testing phases.

ASPM tools provide insights into code vulnerabilities, misconfigurations, and insecure dependencies. They complement WAFs by reducing the number of exploitable flaws that attackers could target. Together, these tools create a holistic security approach, with ASPM focusing on prevention and WAFs providing active defense.

1. Choose the Right Deployment Model

Selecting the right deployment model for a WAF—whether on-premises, cloud-based, or hybrid—is essential for aligning with the needs and infrastructure of an organization. On-premises deployments provide control over hardware and software configurations, suitable for environments with stringent regulatory requirements and performance needs.

Cloud-based WAFs offer scalability and flexibility, minimizing the need for hardware investments and maintenance. Hybrid models combine benefits from both, allowing organizations to deploy the most appropriate features where needed. The choice affects performance, manageability, and integration capabilities.

2. Start with Default Rules

Implementing default rules provided by WAF vendors helps organizations kickstart their defense strategies. These pre-configured rules address common threats and vulnerabilities in web applications, such as SQL injections and XSS. They serve as a foundation for building a customized security policy.

Starting with default rules allows organizations to deploy WAFs quickly while gradually customizing rules based on application requirements and threat landscapes. This approach balances immediate protection needs with the flexibility to improve security measures over time.

3. Perform a Baseline Traffic Analysis

Conducting a baseline traffic analysis is crucial in understanding normal application behavior and identifying potential anomalies. Before deploying WAFs, analyzing traffic patterns helps organizations tailor WAF rules to suit their environment’s needs, reducing the risk of false positives and negatives.

By establishing a traffic baseline, organizations can differentiate between legitimate and suspicious activities. This analysis ensures that the WAF is configured to protect against genuine threats while maintaining application performance and user experience.

4. Enable Virtual Patching

Virtual patching is a strategy employed by WAFs to shield web applications from vulnerabilities without altering the application source code. It works by blocking exploit attempts on known vulnerabilities, giving development teams time to implement permanent fixes. This approach provides immediate protection against emerging threats.

WAFs implement virtual patches through rule updates that address vulnerability exploits. By enabling virtual patching, organizations can mitigate risks quickly and efficiently, maintaining application security while managing the development workload.

5. Regularly Update WAF Signatures

Regular updates to WAF signatures ensure that the protection capabilities of the security tool remain current with the latest threats. Attack vectors evolve rapidly, and outdated signatures can leave applications vulnerable. Regular updates improve the WAF's ability to detect and mitigate emerging threats.

Most WAF vendors proactively manage signatures by continuously monitoring threat feeds and issuing updates. WAF users should immediately apply these updates, and may need to manage conflicts with custom security rules. This process enables WAFs to adapt to new attack methodologies and protect against evolving vulnerabilities.

6. Leverage Bot Mitigation

Bot mitigation is essential in preventing automated attacks like credential stuffing and web scraping, which can harm web applications. WAFs equipped with bot mitigation features identify and control web robots by analyzing traffic patterns for signs of automation, distinguishing legitimate users from bots.

Implementing bot mitigation strategies ensures that only genuine traffic interacts with web applications, maintaining performance and service quality. By leveraging WAF capabilities for bot management, organizations can thwart malicious automated activities, protect sensitive data, and preserve application resources.