Web Application Firewall is a security control that provides complete protection for Web applications in any organisation. It combines two security paradigms for maximum protection:

1. Negative security – reactive, signature-based protection on eliminating all known threats as long as they can be translated into a pattern of traffic or user activity. This control may be compared to the Intrusion Detection class of controls.

2. Positive security – proactive, policy-based protection that limits user transactions to only those actions that are explicitly allowed. The policy consists of a set of rules that limit web request or response entities’ syntax, cardinality and content. In summary, it can be described as “what is not allowed is prohibited”.

Web Application Firewalls operate in a mode that limits malicious or suspicious activity in an efficient way. This can involve blocking a request, responding with arbitrary content, rate-limiting or redirection.

Certain Web Application Firewalls provide DDoS prevention capabilities at the application level. They combine positive and negative security controls to provide additional availability controls, for example:

• Logical Denial of Service attack detection (e.g. Slowloris)
• Bot detection
• Web scrapping detection                 

Positive security relies on a sound policy that requires technical expertise and the investment of time. Web Application Firewalls provide expert systems or wizards that allow for faster deployment and staging of the policy. Such functionality decreases training requirements and allows for the more effective introduction of this security control in an organisation.

Web Application Firewalls also support compliance requirements. As a solution that inspects application flows it offers both pattern discovery and policy enforcement. This helps to achieve compliance with regulations such as PCI DSS as well as assisting SIEM solutions as an additional source of contextual information.

In summary, in today’s security world a web application firewall is a key security technology. When applied correctly it can minimise the risk of application exposure and be an efficient tool in application vulnerability patching.