Creating Order Out Of WAF Management Chaos

Cybercrime is now a major concern for every business. A recent Interpol report found that cybercrime and financial crime are the world’s top criminal threats, with more than 70% of police officers expecting offences like ransomware and phishing attacks to increase over the next three to five years. 

For instance in 2022 alone, the Cybersecurity and Infrastructure Security Agency (CISA) added 66 new vulnerabilities to its Known Exploited Vulnerabilities Catalogue in the US.

Businesses want to protect themselves effectively from this deluge of new threats, with a focus needed on web application firewall (WAF) management and rules. So, what makes WAF rules more effective?

In this journey towards higher levels of cybersecurity, organisations will target a reduction in false positives, false negatives, and alert fatigue. At a high level, it has to do with the special order in which WAF rules are run and the speed in which they are processed – in essence, to provide security without sacrificing performance. 

Peeling Back The Onion

The first step is to look at the different layers of protection in your WAF. In order to provide a holistic level of protection,  a WAF should follow a modular approach, to address different cybersecurity functions:

  •  Access control rules provide the ability to create allowlists, denylists, and positive-security access lists. These filter traffic based on factors such as IP address, country, cookie, or content type.
  •  Rate limiting rules restrict the flow of HTTP requests to an application being protected by  the WAF, preventing malicious or accidental application distributed denial-of-service (DDoS) traffic. This also prevents a customer origin server from being overloaded with requests.
  • Bot manager rules mitigate automated traffic by requiring a client (e.g. a web browser) to solve a challenge before allowing the request to proceed. The WAF prevents requests from reaching the application when the client cannot solve this challenge, blocking basic bot activity. This protects your site from bots scraping your content, carding, spamming your forms, launching DDoS attacks, and committing ad fraud.
  • Custom WAF rules help organisations to identify malicious traffic using a combination of variables (e.g. request headers, body, query, method, URL, cookie). This customisation provides added flexibility for threat detection and enables businesses to filter for specific malicious requests and take action to mitigate them.
  • Managed WAF rules identify malicious traffic via a predefined ruleset. In the case of Edgio WAF, these rules consist of over 500 rules spread across three categories: Edgio Proprietary Rules, advanced application-specific rules, and Generic Open Web Application Security Project (OWASP) rules. This comprehensively collects various security policies and rules for different attack categories and applications. When performing a threat assessment, each managed WAF rule can be customised to prevent false positives by excluding certain variables.

Creating Order Out Of Chaos

Powerful WAF engine aside, the key to gaining clarity is creating a proper order of operations to run the WAF most efficiently and effectively. Best practice would be to run different layers of rule modules in a specific sequence. 

  1. Access control rules:   First, incoming traffic should hit access control rules, where requests are filtered by a static set of access control lists (ACLs) configured by the organisation, where unwanted traffic is blocked. 
  2. Rate limiting rules:   Next, the time windows for requests should be tracked by rate limiting rules, with the WAF dropping any requests that fail to reach the specified threshold. 
  3. Bot manager rules:   Bot manager rules serve browser challenges to detect automated clients or primitive bots.
  4. Custom WAF rules:   For higher precision, the WAF should inspect requests using various bespoke filters. These can include any application-specific rules deployed in real time to mitigate zero-day vulnerabilities without waiting for the managed WAF ruleset to be updated - an invaluable tool to gain visibility and control over specific attacks. 
  5. Managed WAF rules:   Finally, any request that has reached this stage is processed by Managed WAF Rules before they reach the application.

Processing rules in this sequence ensures that multiple layers of filtering capture different kinds of attacks before the precision Managed WAF Rules are triggered.

The effectiveness of a WAF isn’t determined by its ability to mitigate attacks (true positives) alone - it is also defined by its ability to prevent legitimate traffic from being blocked (false positives).

The Power Of Managed WAF Rules

When a request reaches step 5 above, it should be evaluated to mitigate a broad spectrum of application attacks. This presents an additional layer of complexity as there are extensive categories of generic and specific rules. For example, depending on the business infrastructure, organisations may require protection from generic SQL injections (SQLi), cross-site scripting (XSS), or remote code execution (RCE) attacks, or more specific WordPress, Joomla and Apache Struts vulnerabilities. 

As is the case with other WAF rules modules, their sequence is paramount. Businesses must carefully prioritise and customise these rules to ensure they complement each other and maximise accuracy. When organisations customise these rules to ignore specific request parameters, such as request header, cookie, query, and body parameters, they can then quickly remove false positives using a simple user interface or API. 

WAF management can be a tricky element for organisations to tackle but is easier when broken down into manageable pieces. Designing and assembling WAF components and rulesets is like making a hamburger.

It's not just about having the right ingredients - it's about combining them in the right order to make a great meal.

The same ingredients put together differently can drastically impact the taste and the consumer's experience, and the same is true of WAF management. When an intelligent order of operations is combined with various WAF rules modules and Managed WAF Rules, security does not have to impede performance.  

Paul McNamara is Senior Solutions Engineer at Edgio

You Might Also Read: 

Reduce Vulnerabilities & Defend Your Brand Against DDoS Attacks:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« SMBs Are Taking Cybersecurity More Seriously
Insider Threat Management: Keep Up With Growing Threats »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

ThreatConnect

ThreatConnect

ThreatConnect is an enterprise threat intelligence platform by Cyber Squared bridging incident response, defense, and threat analysis for InfoSec & DFIR teams.

XenArmor

XenArmor

XenArmor products include NetCertScanner, an enterprise software to scan & manage expired SSL Certificates on your local network or internet.

Octopus Cybercrime Community

Octopus Cybercrime Community

The Octopus Community is a platform for information sharing and cooperation on cybercrime and electronic evidence.

Gurucul

Gurucul

Gurucul predictive security analytics protects against insider threats, account compromise and data exfiltration on-premises and in the cloud.

Avira

Avira

Avira provide a portfolio of antivirus, security and performance applications for Windows, Android, Mac, and iOS.

NSEIT

NSEIT

NSEIT offers end-to-end Information Technology products, solutions and services including cybersecurity to organizations in the financial sector.

CYRail

CYRail

CYRail project will analyse threats targeting Railway infrastructures and develop innovative attack detection and alerting techniques.

InterGuard

InterGuard

As the pioneer for Unified Insider Threat Prevention and productivity monitoring tools, InterGuard offers on premise and SaaS-based services that are easily available and affordable.

Constella Intelligence

Constella Intelligence

Constella Intelligence provides digital risk protection services to quickly and efficiently disrupt cyber attacks and data breaches before they occur.

Path Forward IT

Path Forward IT

Path Forward IT has been troubleshooting, architecting, migrating, protecting, and securing IT environments for businesses across the USA since 2002.

Quad9 Foundation

Quad9 Foundation

Quad9 is a free security solution that uses DNS to protect your system against the most common cyber threats. It improves your system's performance, plus, it preserves and protects your privacy.

Cognilytica

Cognilytica

Cognilytica’s Cognitive Project Management for AI (CPMAI) training and certification is recognized around the world as the best practices methodology for implementing successful AI & ML projects.

Cyber Suraksa

Cyber Suraksa

We make security simple and hassle-free by offering a sustained and secure IT environment with next-gen cybersecurity solutions through a scalable security-as-a-service model.

Conceal

Conceal

Conceal’s mission is to stop ransomware and credential theft for companies of all sizes by developing innovative solutions that provide social engineering protection in any browser.

Dryad Global

Dryad Global

Dryad Global offers a comprehensive suite of maritime intelligence solutions, including a best-in-class situational awareness, planning and security system and industry-leading cyber protection tools.

SpectrumWise

SpectrumWise

SpectrumWise is a business technology specialist that provides Managed Services and Managed Security for small and medium IT Networks.