Creating Order Out Of WAF Management Chaos

Cybercrime is now a major concern for every business. A recent Interpol report found that cybercrime and financial crime are the world’s top criminal threats, with more than 70% of police officers expecting offences like ransomware and phishing attacks to increase over the next three to five years. 

For instance in 2022 alone, the Cybersecurity and Infrastructure Security Agency (CISA) added 66 new vulnerabilities to its Known Exploited Vulnerabilities Catalogue in the US.

Businesses want to protect themselves effectively from this deluge of new threats, with a focus needed on web application firewall (WAF) management and rules. So, what makes WAF rules more effective?

In this journey towards higher levels of cybersecurity, organisations will target a reduction in false positives, false negatives, and alert fatigue. At a high level, it has to do with the special order in which WAF rules are run and the speed in which they are processed – in essence, to provide security without sacrificing performance. 

Peeling Back The Onion

The first step is to look at the different layers of protection in your WAF. In order to provide a holistic level of protection,  a WAF should follow a modular approach, to address different cybersecurity functions:

  •  Access control rules provide the ability to create allowlists, denylists, and positive-security access lists. These filter traffic based on factors such as IP address, country, cookie, or content type.
  •  Rate limiting rules restrict the flow of HTTP requests to an application being protected by  the WAF, preventing malicious or accidental application distributed denial-of-service (DDoS) traffic. This also prevents a customer origin server from being overloaded with requests.
  • Bot manager rules mitigate automated traffic by requiring a client (e.g. a web browser) to solve a challenge before allowing the request to proceed. The WAF prevents requests from reaching the application when the client cannot solve this challenge, blocking basic bot activity. This protects your site from bots scraping your content, carding, spamming your forms, launching DDoS attacks, and committing ad fraud.
  • Custom WAF rules help organisations to identify malicious traffic using a combination of variables (e.g. request headers, body, query, method, URL, cookie). This customisation provides added flexibility for threat detection and enables businesses to filter for specific malicious requests and take action to mitigate them.
  • Managed WAF rules identify malicious traffic via a predefined ruleset. In the case of Edgio WAF, these rules consist of over 500 rules spread across three categories: Edgio Proprietary Rules, advanced application-specific rules, and Generic Open Web Application Security Project (OWASP) rules. This comprehensively collects various security policies and rules for different attack categories and applications. When performing a threat assessment, each managed WAF rule can be customised to prevent false positives by excluding certain variables.

Creating Order Out Of Chaos

Powerful WAF engine aside, the key to gaining clarity is creating a proper order of operations to run the WAF most efficiently and effectively. Best practice would be to run different layers of rule modules in a specific sequence. 

  1. Access control rules:   First, incoming traffic should hit access control rules, where requests are filtered by a static set of access control lists (ACLs) configured by the organisation, where unwanted traffic is blocked. 
  2. Rate limiting rules:   Next, the time windows for requests should be tracked by rate limiting rules, with the WAF dropping any requests that fail to reach the specified threshold. 
  3. Bot manager rules:   Bot manager rules serve browser challenges to detect automated clients or primitive bots.
  4. Custom WAF rules:   For higher precision, the WAF should inspect requests using various bespoke filters. These can include any application-specific rules deployed in real time to mitigate zero-day vulnerabilities without waiting for the managed WAF ruleset to be updated - an invaluable tool to gain visibility and control over specific attacks. 
  5. Managed WAF rules:   Finally, any request that has reached this stage is processed by Managed WAF Rules before they reach the application.

Processing rules in this sequence ensures that multiple layers of filtering capture different kinds of attacks before the precision Managed WAF Rules are triggered.

The effectiveness of a WAF isn’t determined by its ability to mitigate attacks (true positives) alone - it is also defined by its ability to prevent legitimate traffic from being blocked (false positives).

The Power Of Managed WAF Rules

When a request reaches step 5 above, it should be evaluated to mitigate a broad spectrum of application attacks. This presents an additional layer of complexity as there are extensive categories of generic and specific rules. For example, depending on the business infrastructure, organisations may require protection from generic SQL injections (SQLi), cross-site scripting (XSS), or remote code execution (RCE) attacks, or more specific WordPress, Joomla and Apache Struts vulnerabilities. 

As is the case with other WAF rules modules, their sequence is paramount. Businesses must carefully prioritise and customise these rules to ensure they complement each other and maximise accuracy. When organisations customise these rules to ignore specific request parameters, such as request header, cookie, query, and body parameters, they can then quickly remove false positives using a simple user interface or API. 

WAF management can be a tricky element for organisations to tackle but is easier when broken down into manageable pieces. Designing and assembling WAF components and rulesets is like making a hamburger.

It's not just about having the right ingredients - it's about combining them in the right order to make a great meal.

The same ingredients put together differently can drastically impact the taste and the consumer's experience, and the same is true of WAF management. When an intelligent order of operations is combined with various WAF rules modules and Managed WAF Rules, security does not have to impede performance.  

Paul McNamara is Senior Solutions Engineer at Edgio

You Might Also Read: 

Reduce Vulnerabilities & Defend Your Brand Against DDoS Attacks:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« SMBs Are Taking Cybersecurity More Seriously
Insider Threat Management: Keep Up With Growing Threats »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Kore Telematics

Kore Telematics

Kore is a leading managed service provider for IoT and M2M applications.

FIRST Conference

FIRST Conference

Annual conference organised by the Forum of Incident Response and Security Teams (FIRST), a recognized global leader in computer incident response.

National Defense Industry Association (NDIA)

National Defense Industry Association (NDIA)

The National Defense Industrial Association Cyber Division contributes to US national security by promoting interaction between the cyber defense industry, government and military.

North American Electric Reliability Corporation (NERC)

North American Electric Reliability Corporation (NERC)

NERC is a not-for-profit international regulatory authority whose mission is to assure the reliability and security of the bulk power system in North America.

NetDiligence

NetDiligence

NetDiligence is a privately-held cyber risk assessment and data breach services company.

Verifi

Verifi

Verifi is an award-winning provider of end-to-end payment protection and risk management solutions.

SecSign Technologies

SecSign Technologies

SecSign Technologies delivers user authentication, messaging, file sharing, and file storage with next generation security for company networks, websites, platforms, and devices.

LGMS - LE Global Services

LGMS - LE Global Services

LGMS is a leading cyber security penetration testing and assessment firm in the Asia Pacific region.

SLVA Cybersecurity

SLVA Cybersecurity

SLVA Cybersecurity excel at delivering security-as-a-service, fit-for-purpose, within the constraints of realistic budgets and business expectations.

Aleo

Aleo

Aleo is building the world's leading developer platform for enabling absolute privacy on blockchains.

CFTS

CFTS

CFTS 'Computer Facilities Technical Services' is a Ugandan ICT Support Company that specialises in infrastructure and support services including network security.

Dig Security

Dig Security

Dig Security offers the first data detection and response (DDR) solution, providing real-time visibility, control and protection of your data assets across any cloud.

Strategic Technology Solutions (STS)

Strategic Technology Solutions (STS)

Strategic Technology Solutions specialize in providing Cybersecurity and Managed IT Services to the legal industry.

Cyber & Data Protection

Cyber & Data Protection

Cyber & Data Protection Limited supports Charities, Educational Trusts and Private Schools, Hospitality and Legal organisations by keeping their data secure and usable.

5S Technologies

5S Technologies

5S Technologies is a regional IT solutions and services provider based in Cary, NC and serving the Carolinas.

Velotix

Velotix

Velotix empowers organizations to maximize the value of their data while ensuring security and compliance in a rapidly evolving regulatory landscape.