Web Application Firewalls

Introduction

Web Application Firewalls (WAFs) represent the most advanced firewall capabilities in the industry. Traditionally, firewalls had been focused on network layer traffic, but as attacks became more advanced and climbed up the ladder of the Open Systems Interconnection model, a different kind of inspection was needed. A type of inspection that could not only understand and make sense of network traffic but that could also track session state and ultimately make sense of what was taking place at the application layer.

Arguably, most of the complexity and analysis is needed at the app layer due to the large number of protocols and communication formats that are increasing at a rapid rate. Not only do WAFs need to understand the formats and protocol structures at the application layer, but they need to be able to parse the “good” from the “bad” traffic. WAFs can accomplish this type of protection through several means. One such method is signature-based detection in which a known attack signature has been documented and the WAF parses the traffic looking for a pattern match. Another method involves the application of behavior analysis and profiling. Advanced WAFs can conduct a behavioral baseline to construct a profile and look for deviations relative to that profile.

Throughout this book, we cover topics, including the current application threat landscape, types of attacks, the evolution of WAF technologies, and modern deployment architectures. This report will help you ...