How To Implement Web Application Firewall

You may have chosen to install a web application firewall that offers all the must-have features for compliance. But this does not necessarily mean that it is totally compliant. The WAF must be properly positioned, configured, administered, implemented and monitored. Not only do you have to secure the site with an application firewall; you will also need to keep monitoring, testing and improving upon it.

This forms a continuous cycle which keeps going on and ensures a rather persistent series of protective measures. Before you connect any device to the network, you have to make sure that you have documents of the network infrastructure. You must harden the device on which it will run and this implies applying routine patches and taking time out to configure this device to enhance security. The rules which you have prefixed in your security policies will actually determine how this WAF is to be configured. So, rules and filters are going to define themselves in a WAF. The firewall thus configured will then help to expose all technical problems which exist inside a network or within an application. These include traffic bottlenecks and false positive alerts.

Besides configuration, you will need to perform careful tests when your site uses unusual headers and cookies, or if you are using many language versions for an application. Such tests must match the live environment for the application as far as possible. When you have such an approach to implementing a WAF, you can be sure that all issues concerning system integration will be exposed before the firewall is implemented.

The WAF may be implemented as follows:

- You can have physical WAF which is the hardware-based WAF and installed locally. This is convenient as it minimizes overheads and also reduces latency.
- Virtual WAFs which are implemented in virtual environments like ESX servers or inside public clouds like the Amazon Cloud Services.
- Finally, you can have cloud-hosted WAFs which are the most cost-effective and easiest to deploy. These can be obtained on a subscription basis. They only need minimal changes for re-routing application traffic.

Was this answer helpful? 7 6