How Do Web Application Firewalls Work?

Web applications, websites and web servers are unarguably the biggest targets for cyber criminals. Some of these attacks are DDoS attacks, cross-scripting attacks or XSS attacks and SQL injection attacks. So, you can either create more resilient apps to ward off such attacks or use specially designed WAFs or Web Application Firewalls.

The Web Application Firewall (WAF) is used as a hardware appliance or a server plug-in which can run on the servers directly. It is meant to intercept every HTTP request and analyze it before it reaches the server for processing. Depending on the options you have chosen to deploy, the WAF can successfully block traffic or challenge visitors by asking for a Captcha or order servers to simulate attacks. The WAF is not the same as a traditional firewall because it performs other functions than simply blocking specific IP addresses. It will inspect the web traffic closely to detect signs of XSS and SQL injection attacks. The WAF is also customizable and lets you write rules which are specific to an application.

Regardless of whether the WAF is software or hardware, it will analyze the POST and GET requests which are being sent via HTTP and HTTPS and it will also apply the pre-set firewall rules for detecting and filtering malicious traffic. So, WAF is a special application firewall which will analyze packet content, not simply the headers. This is why it can catch any malicious traffic which may have gone unnoticed by other security appliances. If you can implement the WAF properly, you can also ensure that your company complies with all HIPAA and PCI-DSS rules.

The WAF is configured according to 3 types of security models where one type can be more effective compared to others depending on the application it is meant for. The whitelisting model will allow web traffic depending on some specific criteria. This is best for a broad coverage for all possible cyber attacks, but in the process may even block some legitimate traffic. The blacklisting model will use pre-set signatures for blocking web traffic which is found to be malicious. Blacklisting firewalls can successfully prevent the DDoS attacks. They are best suited for websites on the Internet as these may receive a lot of legitimate traffic from unknown client servers. There is also a third hybrid model blending in features of both blacklisting and whitelisting models. These are best for web apps on the internal network and apps on public Internet.

Was this answer helpful? 8 10