Creating Order Out Of WAF Management Chaos

Cybercrime is now a major concern for every business. A recent Interpol report found that cybercrime and financial crime are the world’s top criminal threats, with more than 70% of police officers expecting offences like ransomware and phishing attacks to increase over the next three to five years. 

For instance in 2022 alone, the Cybersecurity and Infrastructure Security Agency (CISA) added 66 new vulnerabilities to its Known Exploited Vulnerabilities Catalogue in the US.

Businesses want to protect themselves effectively from this deluge of new threats, with a focus needed on Web Application Firewall (WAF) management and rules. So, what makes WAF rules more effective?

In this journey towards higher levels of cybersecurity, organisations will target a reduction in false positives, false negatives, and alert fatigue. At a high level, it has to do with the special order in which WAF rules are run and the speed in which they are processed – in essence, to provide security without sacrificing performance. 

Peeling Back The Onion

The first step is to look at the different layers of protection in your WAF. In order to provide a holistic level of protection,  a WAF should follow a modular approach, to address different cybersecurity functions:

  •  Access control rules provide the ability to create allowlists, denylists, and positive-security access lists. These filter traffic based on factors such as IP address, country, cookie, or content type.
  •  Rate limiting rules restrict the flow of HTTP requests to an application being protected by  the WAF, preventing malicious or accidental application distributed denial-of-service (DDoS) traffic. This also prevents a customer origin server from being overloaded with requests.
  • Bot manager rules mitigate automated traffic by requiring a client (e.g. a web browser) to solve a challenge before allowing the request to proceed. The WAF prevents requests from reaching the application when the client cannot solve this challenge, blocking basic bot activity. This protects your site from bots scraping your content, carding, spamming your forms, launching DDoS attacks, and committing ad fraud.
  • Custom WAF rules help organisations to identify malicious traffic using a combination of variables (e.g. request headers, body, query, method, URL, cookie). This customisation provides added flexibility for threat detection and enables businesses to filter for specific malicious requests and take action to mitigate them.
  • Managed WAF rules identify malicious traffic via a predefined ruleset. In the case of Edgio WAF, these rules consist of over 500 rules spread across three categories: Edgio Proprietary Rules, advanced application-specific rules, and Generic Open Web Application Security Project (OWASP) rules. This comprehensively collects various security policies and rules for different attack categories and applications. When performing a threat assessment, each managed WAF rule can be customised to prevent false positives by excluding certain variables.

Creating Order Out Of Chaos

Powerful WAF engine aside, the key to gaining clarity is creating a proper order of operations to run the WAF most efficiently and effectively. Best practice would be to run different layers of rule modules in a specific sequence. 

  1. Access control rules:   First, incoming traffic should hit access control rules, where requests are filtered by a static set of access control lists (ACLs) configured by the organisation, where unwanted traffic is blocked. 
  2. Rate limiting rules:   Next, the time windows for requests should be tracked by rate limiting rules, with the WAF dropping any requests that fail to reach the specified threshold. 
  3. Bot manager rules:   Bot manager rules serve browser challenges to detect automated clients or primitive bots.
  4. Custom WAF rules:   For higher precision, the WAF should inspect requests using various bespoke filters. These can include any application-specific rules deployed in real time to mitigate zero-day vulnerabilities without waiting for the managed WAF ruleset to be updated - an invaluable tool to gain visibility and control over specific attacks. 
  5. Managed WAF rules:   Finally, any request that has reached this stage is processed by Managed WAF Rules before they reach the application.

Processing rules in this sequence ensures that multiple layers of filtering capture different kinds of attacks before the precision Managed WAF Rules are triggered.

The effectiveness of a WAF isn’t determined by its ability to mitigate attacks (true positives) alone - it is also defined by its ability to prevent legitimate traffic from being blocked (false positives).

The Power Of Managed WAF Rules

When a request reaches step 5 above, it should be evaluated to mitigate a broad spectrum of application attacks. This presents an additional layer of complexity as there are extensive categories of generic and specific rules. For example, depending on the business infrastructure, organisations may require protection from generic SQL injections (SQLi), cross-site scripting (XSS), or remote code execution (RCE) attacks, or more specific WordPress, Joomla and Apache Struts vulnerabilities. 

As is the case with other WAF rules modules, their sequence is paramount. Businesses must carefully prioritise and customise these rules to ensure they complement each other and maximise accuracy. When organisations customise these rules to ignore specific request parameters, such as request header, cookie, query, and body parameters, they can then quickly remove false positives using a simple user interface or API. 

WAF management can be a tricky element for organisations to tackle but is easier when broken down into manageable pieces. Designing and assembling WAF components and rulesets is like making a hamburger.

It's not just about having the right ingredients - it's about combining them in the right order to make a great meal.

The same ingredients put together differently can drastically impact the taste and the consumer's experience, and the same is true of WAF management. When an intelligent order of operations is combined with various WAF rules modules and Managed WAF Rules, security does not have to impede performance.  

Paul McNamara is Senior Solutions Engineer at Edgio

You Might Also Read: 

Reduce Vulnerabilities & Defend Your Brand Against DDoS Attacks:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« SMBs Are Taking Cybersecurity More Seriously
Insider Threat Management: Keep Up With Growing Threats »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Tines

Tines

The Tines security automation platform helps security teams automate manual tasks, making them more effective and efficient.

Fuel Recruitment

Fuel Recruitment

Fuel Recruitment is a specialist recruitment company for the IT, Telecoms, Engineering, Consulting and Marketing industries.

Securi-Tay

Securi-Tay

Securi-Tay is an information Security conference held by the Ethical Hacking Society at Abertay University, Dundee.

Fortify Experts

Fortify Experts

Fortify Experts is a search and recruitment firm specializing in Cyber Security.

IPCopper

IPCopper

IPCopper specializes in network packet capture appliances for cybersecurity, cybersurveillance and network monitoring, and encrypted data storage.

Usenix

Usenix

Usenix brings together the community of engineers, system administrators, scientists, and technicians working on the cutting edge of computing.

Gradiant

Gradiant

Gradiant’s mission is to contribute to the growth and competitive improvement of Galician businesses through technology development and innovation using ICT.

Marvell Technology Group

Marvell Technology Group

Marvell is a semiconductor company providing solutions for storage, processing, networking, security and connectivity.

Dataprovider.com

Dataprovider.com

Our Brand Protection Suite gives you the tools to discover trademark infringement on the Internet, such as websites selling counterfeit products, even when this is not immediately noticeable.

Port53 Technologies

Port53 Technologies

Port53 Technologies is focused on delivering enterprise-grade, cloud-delivered security solutions that are easy to deploy, simple to manage and extremely effective.

Curtail

Curtail

Curtail keeps businesses running by using live traffic analysis to identify defects before software goes live, and detect and isolate security threats before they impact systems.

DataPassports

DataPassports

DataPassports is a data-centric security and privacy solution that enforces privacy and security from end-to-end with transparent protection of data at the source.

Venkon

Venkon

Venkon provides effective and unique solutions to cyber-security threats and IT compliance requirements of your organization.

TRU Staffing Partners

TRU Staffing Partners

TRU Staffing Partners is an award-winning contract staffing and executive search firm for cybersecurity, eDiscovery and privacy companies and professionals.

National Cryptologic Foundation (NCF) - USA

National Cryptologic Foundation (NCF) - USA

The National Cryptologic Foundation strives to influence the cryptologic future by sharing our educational resources, stimulating new knowledge, and commemorating our heritage.

Cloudsec Asia

Cloudsec Asia

Cloudsec Asia is Thailand's top-ranked cybersecurity consultant company. We offers security services to ensure that all your IT assets are reliable, accessible, and secure.

Oxeye

Oxeye

Oxeye fills the gap between cloud and code to show exploitable vulnerabilities, and their path from API to code. More visibility. Less noise. More time to build.

Blink Ops

Blink Ops

Blink helps security teams streamline everyday workflows and protect your organization better.

Virtual IT Group (VITG)

Virtual IT Group (VITG)

VITG is a cyber security-focused Managed Service Provider (MSP).