Cyberstudy
PDF p.142 In progress

Web Application Firewalls

Open PDF at p.142 15 flashcards

Summary

PDF p.142

A web application firewall (WAF) protects web server software and back-end databases from code injection and denial of service attacks. WAFs use application-aware rules to filter traffic and detect intrusions, blocking requests with suspect code. They can be deployed as appliances or plug-in software for web server platforms.

In plain words

Supplementary — not from your PDF

A web application firewall (WAF) protects web applications and their databases. It understands HTTP and applies application-aware rules and signatures to block requests containing suspicious code, such as injection attempts, and it logs what it finds. It can be an appliance in front of the web zone or a plug-in on the web server.

Detailed explanation

PDF p.142
  • Function
    • Protection: Safeguards web server software and back-end databases.
    • Threats: Defends against code injection and denial of service attacks.
    • Traffic Filtering: Uses application-aware processing rules.
    • Intrusion Detection: Performs application-specific intrusion detection.
  • Operation
    • Signatures: Programmed with known attack signatures.
    • Pattern Matching: Blocks requests containing suspect code.
    • Logging: Writes output to logs, revealing potential threats to the web application.
  • Deployment
    • Appliance: Protects the zone where the web server is placed.
    • Plug-In Software: Integrated into the web server platform.

Important terms

taken from the text above
Threats
Defends against code injection and denial of service attacks.
Traffic Filtering
Uses application-aware processing rules.
Intrusion Detection
Performs application-specific intrusion detection.
Signatures
Programmed with known attack signatures.
Pattern Matching
Blocks requests containing suspect code.
Logging
Writes output to logs, revealing potential threats to the web application.
Appliance
Protects the zone where the web server is placed.
Plug-In Software
Integrated into the web server platform.

Examples & real-world scenarios

Supplementary — not from your PDF
  • A WAF blocking a request with SQL injection syntax in a form field.
  • A WAF plug-in running on the web server platform.
  • Reviewing WAF logs to see which attacks are hitting your site.

Scenario

A company's older web app can't be patched quickly. A WAF with injection signatures in front of it reduces the risk while the code is fixed, as a compensating control.

Common mistakes

Supplementary — not from your PDF
  • Thinking a network firewall allowing port 443 protects the web app. It doesn't inspect the application requests.
  • Treating a WAF as a replacement for secure coding.

Practical skills

Supplementary — not from your PDF
  • Explain what a WAF inspects that a packet filter can't.

What I should remember

Key Points PDF p.142
  • Function
    • Protection: Web server software, back-end databases.
    • Threats: Code injection, denial of service.
    • Traffic Filtering: Application-aware rules.
    • Intrusion Detection: Application-specific.
  • Operation
    • Signatures: Known attack signatures.
    • Pattern Matching: Blocks suspect code.
    • Logging: Reveals potential threats.
  • Deployment
    • Appliance: Zone protection.
    • Plug-In Software: Web server integration.