Why Replace Traditional Web Application Firewall (WAF) With New Age WAF?

At present, web applications have become the top targets for
attackers because of potential monetization opportunities. Security
breaches on the web application can cost millions. Strikingly, DNS
(Domain Name System) related outage and Distributed denial of
service (DDoS) lead a negative impact on businesses. Among the wide
range of countermeasures, a web application firewall is the first
line of defense.

Web Application Firewall’s basic function is to establish a
hardened boundary to prevent certain malicious traffic types from
acquiring resources. Though WAFs have been available since the late
nineties, this early generation technology is no match for recent
sophisticated cyber-attacks. They are not capable enough to offer
full application control and visibility. With these increasing
security risks, the new age web application firewall is the only
solution that can provide proper protection.

Traditional WAFs Died Or At Least Dying

In the early days, web apps were less common, and so do web
threats. Malevolent bots were less sophisticated and
straightforward to detect. Cybersecurity requirements were very
minimal and could be tackled with basic cybersecurity
management.

Today everything has changed. Web apps can live in on-premises,
cloud, or hybrid environments. Customers and employees access them
through the web from anywhere. As such, the firewall can’t track
what is going on, where the requests are coming, where they are
going, and so on as the IP addresses are constantly changing and
are obscured by CDN.

WAFs should protect against a wide variety of challenging and
complicated threats. Traditional WAFs are implemented as hardware
appliances, which are hard to use and suffer from a lack of
visibility and poor performance. To such an extent, 90% of
organizations state that their WAFs are too complicated.

According to the study of Ponemon^[1], 65% of organizations
experienced bypass in their WAFs, while only 9% said they hadn’t
been breached. However, there is no guarantee that they will never
experience it in the future. Corporates are right to be worried
about the performance and security of their WAFs.

Ponemon’s study also states that only 40% of respondents are
satisfied with their existing WAF, which means they are not using
it to its full potential. Few companies admitted they only use WAF
to generate security alerts rather than to block suspicious
activity.

At worst, organizations are burned on WAF and regretted to have
invested so many assets to make no progress on protecting what
matters to them. This is where the requirement for a New Age Web
application firewall comes in. The New Age WAFs such as AppTrana^[2]
are cloud-based, managed, easier to deploy and have a more
convenient subscription business model and backed with the
expertise to manage the policies on an ongoing basis so that
businesses can focus on their core expertise without having to
learn new complex skills for application security.

Challenges with Traditional WAF

We often hear from industry members who switched from
traditional Web Application Firewall to next Gen WAF what made them
switch. Most of the reasons represent a variation of the
followings:

1 — Technical Innovation

Web application standards are continually evolving, which raises
the requirement of what WAFs must offer.

The growing adoption of JSON payloads and HTTP/2 has left most
web application firewall vendors battling to keep up. While the
market expects constant innovation, many WAF providers are growing
progressively fragile.

2 — Lack of Scalability

An organization’s requirements for network scaling intensify some
of the challenges like costly, time-consuming, and complexity.
Deploying, as well as maintaining clusters of appliances, becomes
very complex.

DevOps and Agile methodologies require consistent
re-configuration and re-tuning of the clusters that strain the
security team’s resources.

3 — Zero-day Exploits

While WAFs effectively monitor web traffic to prevent HTTP-specific
attacks, they’re incapable of defending from zero-day attacks^[3]. WAFs are designed to
detect pre-configured patterns – Zero-day vulnerabilities can be
exploited by any risk vectors, which are uncovered under the
pre-configured rules.

4 — Blocking Legitimate Traffic

Another dissatisfaction with most of the WAF users is inadvertent
blocking of valid traffic, also known as false positives. While
this sounds relatively harmless in terms of security, it can be
disastrous for organizations. It might block the visitors from
benefiting from the app functionalities, from uploading media or
buying products.

One possible way to combat this challenge is to execute the bare
minimum number of patterns, but this could make the network more
vulnerable. Most WAF solutions find it difficult to balance the
action. Unless you put in dedicated resources to manage it, getting
the value of the traditional WAF is tough. This is the biggest gap
because the traditional WAF failed to live up to its promise.

5 — DDoS Attacks

Most importantly, DDoS difficulties pose issues for WAF
installation. We have seen a significant number of organizations
use WAFs to prevent DDoS attacks. The main reason they claim is
that WAFs can be upgraded to mitigate DDoS attacks^[4].

However, the problem is that traditional WAFs were not set up to
withstand large-scale DDoS attacks. Moreover, today’s applications
are shared/provided by 3rd party platforms, which can’t be
protected by an on-premises layer of defense. Without a cloud-based
WAF, it is tough to plan for upfront capacity, and even if you do,
it will still have an upper limit.

Cloud WAF and especially managed cloud WAF address this problem
with the ability to scale up and down. The business has to pay only
based on value without having to pay upfront fixed cost for a
future possibility that may or may not happen.

Understanding the Capabilities of New Age WAF

Though many WAF providers are claiming to offer the next
generation, most of them are using the same security paradigms as
traditional WAFs, and hence it is not NextGEN. We need a New Age
WAF that becomes truly next GEN. An essential characteristic of
new-age WAFs, as seen in Indusface’s AppTrana, include:

1 — Application and Web Usage Control

Application and web usage control answers the concern, what type of
traffic is blocked? The WAF uses multiple identification categories
to identify their exact identity of websites and applications
crossing the network and determine how to treat them.

Accurate traffic classification is the core of next-gen WAF.
This prevents organizations from accessing websites and apps that
could create legal issues or be malicious, or have no
relevance.

2 — Advanced Web Application Security Analytics

Not only does the cloud-based WAF address emerging attacks that
most web apps are experiencing, but it offers steady improvements
to threat visibility and analytics. In traditional WAFs,
enterprises fly blind, hoping everything is “FINE” until something
goes wrong.

WAFs monitors performance metrics in real-time, highlighting
what is happening in your infrastructure, applications, and
end-users. You can react before anything goes wrong, and you can
trust your WAF is functioning as intended.

3 — Web Application security assessment and Malware
Detection

New-Age Firewalls understand that even valid sites may unknowingly
hold vulnerabilities and maybe even links to malware sites and
malicious payload. Also, a business sometimes wants to give access
to a social media platform that often includes malicious links or
files.

Providing a WAF policy that is correlated with the risk of the
application and doing it continuously is the main benefit of new
Age WAF such as AppTrana^[5].

4 — Global Threat Intelligence

This cloud-based security platform leverages its international
deployments and maintains a complete insight into global traffic
trends. It monitors and analyzes the traffic of all global
deployments. Once a security threat is identified in one location,
all deployments worldwide are updated as well as toughened against
it.

5 — Automated Intervention

Cloud-based WAFs not only rely on predefined policies and
signatures to block traffic but also provides managed services for
accurate risk-based custom rules. It continuously monitors and
automatically filters out valid requests and malicious actors based
on real-time pattern and behavioral analysis. It also offers
virtual patching to prevent the exploits of weak spots like
zero-day vulnerabilities.

Moving Forward

There are key differences between traditional and new-age WAF.
If the traditional WAF goes inadequate for whatever reasons, your
web app will be reachable for attackers. It would be best to opt
for advanced web protection, which doesn’t adversely influence your
business operations. New-age cloud-based WAF is built to offer
adequate web protection and give the value of your money.