Cookie poisoning, also known as session hijacking, is when a cybercriminal manipulates or forges a cookie to bypass security or gain access to the server to steal data. This type of attack is used when a user is required to login to an account and the cybercriminal intercepts the cookie to extract saved information from it, such as auto-filled personal information. WAFs can prevent this from happening by protecting and encrypting personal identifiable information as well as identifying altered or "poisoned" cookies from reaching the server.
Similar to cookie poisoning, Cross-Site Scripting, or XSS, is a type of injection involving malicious scripts. Cybercriminals send malicious code through the web application directly to a different end user to attempt to access cookies or other sensitive data saved in the browser and used by the web application. WAF can help prevent against this with configured policies to scan and monitor these requests and block them when safe conditions are not matched. If identified by the WAF as malicious XSS code, it will block it from gaining access.
SQL stands for Structured Query Language and is a common programming language. SQL injection is when a cybercriminal modifies queries an application makes which can grant them access to important personal or financial information. WAF can prevent against this by running off rules that require SQL injections to match specified conditions and if they do not, it will block the user from even reaching the web application.
This type of attack involves several devices that have been infected with malware overwhelming a web application by creating an unusual amount of traffic. This causes a denial-of-service to normal traffic, cause performance issues, and weaken the layers of security. A WAF can identify and block this type of unusual activity based on key indicators such as high levels of traffic from a single IP address, unusual traffic patterns, or high traffic on a specific page.
Web Application Firewall Solutions
A WAF creates a shield between a web app and the Internet; this shield can help mitigate many common attacks.
Introduction
A WAF or web application firewall helps protect web applications by filtering and monitoring HTTP traffic between a web application and the Internet. It typically protects web applications from attacks such as cross-site forgery, cross-site-scripting (XSS), file inclusion, and SQL injection, among others. A WAF is a protocol layer 7 defense (in the OSI model), and is not designed to defend against all types of attacks. This method of attack mitigation is usually part of a suite of tools which together create a holistic defense against a range of attack vectors.
By deploying a WAF in front of a web application, a shield is placed between the web application and the Internet. While a proxy server protects a client machine’s identity by using an intermediary, a WAF is a type of reverse-proxy, protecting the server from exposure by having clients pass through the WAF before reaching the server.
A WAF operates through a set of rules often called policies. These policies aim to protect against vulnerabilities in the application by filtering out malicious traffic. The value of a WAF comes in part from the speed and ease with which policy modification can be implemented, allowing for faster response to varying attack vectors; during a DDoS attack, rate limiting can be quickly implemented by modifying WAF policies.
Types of WAF Solutions That Are Available
A WAF can be implemented in one of three different ways, each with its own benefits and shortcomings:
A network-based WAF is generally hardware-based. Since they are installed locally they minimise latency, but network-based WAFs are the most expensive option and also require the storage and maintenance of physical equipment.
A host-based WAF may be fully integrated into an application’s software. This solution is less expensive than a network-based WAF and offers more customisation. The downside of a host-based WAF is the consumption of local server resources, implementation complexity, and maintenance costs. These components typically require engineering time, and may be costly.
Cloud-based WAFs offer an affordable option that is very easy to implement; they usually offer a turnkey installation that is as simple as a change in DNS to redirect traffic. Cloud-based WAFs also have a minimal upfront cost, as users pay monthly or annually for security as a service. Cloud-based WAFs can also offer a solution that is consistently updated to protect against the newest threats without any additional work or cost on the user’s end. The drawback of a cloud-based WAF is that users hand over the responsibility to a third party, therefore some features of the WAF may be a black box to them.
Web Application Firewall Benefits
Prevents Cookie Poisoning
Prevents Cross-Site Scripting (XSS)
Prevents SQL Injection
Blocks Distributed Denial of Service (DDoS)
Frequently Asked Questions
What is a Web Application Firewall?
Web Application Firewalls, or WAF, block an ever-expanding list of sophisticated web-based intrusions and attacks that target the applications hosted on web servers and the sensitive or confidential data to which they have access.
Who needs a Web Application Firewall?
Does your organization have a website or other web applications? If you answered yes, then you should consider using a WAF. Even small websites are a target for cybercriminals, especially since this type of security is often neglected in small organizations, putting you at risk regardless of how unlikely you perceive it to be.
Nearly 70% of all websites use HTTPS, an important first step in securing any data your website collects, such as customer or payment information. Unfortunately, HTTPS is the bare minimum security requirement, and is not enough to stop cybercriminals from infiltrating your database and stealing sensitive customer information. Because a WAF uses a set of policies to filter and block unwanted web traffic as well as protect against the most common types of hacks on a continuous basis, it can help secure you in ways that HTTPS is unable to. It also helps increase site speed and performance by using caching mechanisms.
How does a Web Application Firewall Work?
Just as your organization’s firewall stands as a shield around your IT infrastructure to filter traffic and protect against cybercriminals, your WAF is a firewall that shields your web applications from the same kind of malicious activity. A WAF protects by monitoring the HTTP traffic and filtering out malicious activity to prevent it from reaching the server. WAFs run off a set of policies to help determine what traffic is malicious by indicating what vulnerabilities and traffic behavior to identify.
WAFs can be configured into three general models: Whitelisting, Blacklisting, and Hybrid. Whitelisting tells the WAF to only allow in traffic that has been pre-approved and meets specified criteria. Blacklisting is configured to block known vulnerabilities and malicious signatures but allow all other traffic. Hybrid is configured to incorporate both whitelisting and blacklisting methods for the specific need of the web application.