Web application firewall

A Web Application Firewall (or WAF) filters, monitors, and blocks HTTP traffic to and from a web application. A WAF is differentiated from a regular firewall in that a WAF is able to filter the content of specific web applications while regular firewalls serve as a safety gate between servers. By inspecting HTTP traffic, it can prevent attacks stemming from web application security flaws, such as SQL injection, Cross-Site Scripting (XSS) and security misconfigurations.

History

Application firewalls, which control input, output, and access from applications or services, were first developed in the early 1990s by Gene Spafford, Bill Cheswick, and Marcus Ranum.^[1] Their product was largely a network based Firewall but could handle few applications (like FTP or RSH) and was released to market by DEC. Within the next few years, the products were further developed by other researchers to provide a stable firewall software for others to build on, and raised the bar for the industry.

Dedicated Web Application Firewalls entered the market later in the decade, when web server hacker attacks were becoming much more noticeable.

The first company to offer a dedicated Web Application Firewall was Perfecto Technologies with its AppShield product,^[2] which focused on the ecommerce market and protected against illegal web page character entries. Perfecto renamed itself as Sanctum and named^[3] the top 10 web application hacking techniques and laid the foundations for the WAF market:

• Hidden Field Manipulation
• Cookie Poisoning
• Parameter Tampering
• Buffer Overflow
• Cross Site Scripting (XSS)
• Backdoor or Debug options
• Stealth Commanding
• Forceful Browsing
• Third party mis-configurations
• Known Vulnerabilities

In 2002, the open source project ModSecurity^[4] was formed in order to make WAF technology more accessible and solve the obstacles within the industry like business cases, cost barriers, and proprietary rule-sets. ModSecurity finalized a core rule set for protecting Web Applications, based on the OASIS Web Application Security Technical Committee’s (WAS TC) vulnerability work. In 2003, their work was expanded and standardized through the Open Web Application Security Project’s (OWASP) Top 10 List, an annual ranking for web security vulnerabilities. This list would become the industry benchmark for many compliance themes.

Since then, the market has continued to grow and evolve, involving the larger commerce industry with the rise in credit card fraud. With the development of Payment Card Industry Data Security Standard (PCI DSS), a standard for organizations to increase controls on cardholder data, security is more regulated and has sparked wide-scale interest in the industry. According to Forrester, the WAF market exceeded $200M in size by 2010.

Description

A Web Application Firewall is a special type of application firewall that applies specifically to web applications. It is deployed in front of web applications and analyzes bi-directional web-based (HTTP) traffic - detecting and blocking anything malicious. The OWASP provides a broad technical definition for a WAF as “a security solution on the web application level which - from a technical point of view - does not depend on the application itself.”^[5] According to the PCI DSS Information Supplement for requirement 6.6, a WAF is defined as “a security policy enforcement point positioned between a web application and the client end point. This functionality can be implemented in software or hardware, running in an appliance device, or in a typical server running a common operating system. It may be a stand-alone device or integrated into other network components.”^[6] In other words, a WAF can be a virtual or physical appliance that prevents vulnerabilities in web applications from being exploited by outside threats. These vulnerabilities may be because the application itself is a legacy type or it was insufficiently coded by design. The WAF addresses these code shortcomings by special configurations of rule-sets, also known as policies.

Previously unknown vulnerabilities can be discovered through penetration testing or via a vulnerability scanner. A web application vulnerability scanner, also known as a web application security scanner, is defined in the SAMATE NIST 500-269 as “an automated program that examines web applications for potential security vulnerabilities. In addition to searching for web application-specific vulnerabilities, the tools also look for software coding errors.”^[7] Resolving vulnerabilities is commonly referred to as remediation. Corrections to the code can be made in the application but typically a more prompt response is necessary. In these situations, the application of a custom policy for a unique web application vulnerability to provide a temporary but immediate fix (known as a virtual patch) may be necessary.

WAFs are not an ultimate security solution, rather they are meant to be used in conjunction with other network perimeter security solutions such as network firewalls and intrusion prevention systems to provide a holistic defense strategy.

WAFs typically follow a positive security model, a negative security, or a combination of both as mentioned by the SANS Institute.^[8] WAFs use a combination of rule-based logic, parsing, and signatures to detect and prevent attacks such as cross-site scripting and SQL injection. The OWASP produces a list of the top 10 web application security flaws. All commercial WAF offerings cover these 10 flaws at minimum. There are non-commercial options as well. As mentioned earlier, the well-known open source WAF engine called ModSecurity is one of these options. A WAF engine alone is insufficient to provide adequate protection, therefore OWASP along with Trustwave's Spiderlabs help organize and maintain a Core-Rule Set via GitHub^[9] to use with the ModSecurity WAF engine.^[10]

Deployment Options

Although the names for operating mode may differ, WAFs are basically deployed inline in three different ways. According to the NSS Labs, deployment options are transparent bridge, transparent reverse proxy, and reverse proxy.^[11] Transparent refers to the fact that the HTTP traffic sent straight to the web application, e.g. the WAF is transparent between the client and server. This is contrast to reverse proxy, where the WAF acts as a proxy and the client’s traffic is sent directly to the WAF. The WAF then separately sends filtered traffic to web applications. This can provide additional benefits such as IP masking but may introduce disadvantages such as performance latency.

Commercial Vendors

Many commercial WAFs have similar features, but major differences often refer to user interfaces, deployment options, or requirements within specific environments.

Appliance

• Barracuda Networks WAF
• Citrix Netscaler Application Firewall
• F5 Big-IP Application Security Manager
• Penta Security’s WAPPLES
• Imperva SecureSphere
• Fortinet FortiWeb
• Positive Technologies PT Application Firewall

Cloud

• Cloudbric
• Cloudflare
• F5 Silverline
• Imperva Incapsula

Open Source Option

Open source solutions are available to the public for general usage.

• ModSecurity

See also

• Application Firewall
• PCI DSS
• Web Application
• Software as a Service (SaaS)
• Computer Security
• Network Security
• Application Security
• Web Application Security

References