How to Build A WAF At the Application Layer?

WAF or a Web Application Firewall is an essential security tool/ product that allows you to proactively protect your websites/ web applications from malicious attacks and maintain a strong defense against bad actors/ traffic. Web App Firewalls protect against known threats such as SQL injection, DDoS attacks, Cross-Site Forgery, Cross-Site Scripting (XSS), file inclusion, and clickjacking, among others.

Building and deploying WAFs in today’s modern IT environments, increasingly complex applications with several moving parts and third-party components is a critical-yet-tough process. Here is a guide to help you navigate this process.

How WAF Works?

The Web Application Firewall is a transparent reverse proxy in front of the application to ensure that all traffic passes through it and separately sends filtered traffic to the application, hiding the IP address of the application service. It essentially monitors and parses all requests based on the rules (called policies) before they reach your web server/ application. These policies equip the Web App Firewall to ensure that malicious requests and payload do not degrade, compromise, or expose your applications to DDoS or other threats, or cause an exfiltration of data. The policies tell the firewall what needs to be done if vulnerabilities or misconfigurations are found.

The groundwork: Understand the application/ website and how the WAF context relates to it

Planning is the crucial first step in building a Firewall. Understand and analyze app-related engineering concerns, your unique context, and specialized needs from web app security. Remember that traditional/ legacy approaches to web security and a one-size-fits-all open-source Web App Firewall do not make the cut, given the increasing complexity and dynamism of today’s world. So, it is crucial to understand what your objectives are, where the WAF sits in your security solution, and accordingly, tailor security.

Based on your needs, context, and budgetary constraints, you must decide how your Firewall will be deployed – as hardware, software, or as a cloud WAF. Each of these modes of deployment has its own unique benefits and weaknesses. However, cloud WAF is widely preferred by organizations and security experts owing to its cost-effectiveness, easy deployment, scalability, and agility.

Another important decision is whether you want to build the WAF yourself or onboard it on a comprehensive and intelligent solution like the ones provided by AppTrana. In either case, you will have to go through the following steps.

Choose the right security model

There are 3 security models that Web App Firewall follows –

Blacklist/ Negative model which allows all traffic while monitoring and preventing/ blocking all known threats and malicious requests. It requires the WAF to continuously engage in behavioral learning, else, the model becomes ineffective.

Whitelist/ Positive model wherein all expect pre-approved requests/ traffic are blocked. It could lead to high false positives (legitimate requests being denied) which is detrimental and so, regular and continuous tuning and configurations are indispensable for this model to be effective.

The hybrid security model combines the positive and negative models to minimize the drawbacks of both and heighten web app security.

You must choose the right model for your context and needs.

The model the WAF provides is just the starting point for deployment and given the dynamic nature of Web applications a hybrid security model is/should be the starting for any serious transactional web applications and after it is deployed how you configure it is when you start getting real value from WAF.

Create and configure the WAF policies

In the next step, you need to lay down all necessary policies, starting with the basic policies first – analyzing traffic, understanding patterns and MO of OWASP and other known vulnerabilities, action on uncovering vulnerabilities, etc. If you are onboarding to a service, the Web App Firewall will already have default policies.

Once the basic policies are laid down, you must configure and tune these policies and create custom policies in line with your context and needs identified in the planning stage. For instance, if you do not serve in specific countries or continents, you can block those geographies from accessing your application/ website. Similarly, there could be flaws arising from business logic/ policy changes. So, the WAF policies need to be tuned continuously.

You must also enable logging and security analytics in the WAF so that security experts can closely monitor and manage security. It is crucial as there exist flaws that go unnoticed by machines and only a human expert can catch and rectify.

Most importantly try to keep the WAF policies updated to provide defenses against existing application security risk that you may uncover with Web application security assessments and build on those policies and attacks as a foundation for creating future application-specific updates on your WAF.

Make the WAF intelligent with AI-ML

By continuously trying WAF policy updates based on existing risks you uncover in your application from security testing feeds and also understanding of the attacks happening on your website, you can make the Web App Firewall more effective. It will continuously learn from past attack history and global threat intelligence and mapping it to your existing application security risks will enable you to minimize your risks more accurately. AppTrana’s WAF, equipped with providing application context-specific updates by integrating application security risk assessment and managed custom rules/updates to your WAF policies.

Keep yourself updated on the latest on the security front

Your Web Application Firewall is only as effective as the rules and models you choose. Being updated on the latest happening and best practices on the security front will enable you to tune your WAF and your security solution better.

Stay tuned for more relevant and interesting security articles. Follow Indusface on Facebook, Twitter, and LinkedIn.