The web application firewall (WAF) functions as a flexible barrier that filters all application access by inspecting all traffic that passes through it. WAFs are specifically designed to mitigate attacks without blocking legitimate users or slowing down web application performance.
A WAF differs from a traditional network firewall because it detects data in greater detail. For example, it can validate form field input and protect application cookies. A network firewall and a WAF are often used together to provide complementary security levels.
Application based protection.
Web-based applications can be vulnerable to many threats. Although many of these threats can be prevented by application developers, they often fall outside of a website owner's control. When a threat goes unnoticed in development, the WAF filters all application access to inspect both the traffic towards the web application and the response.
By securing both the application infrastructure as well as the application user, a WAF complements traditional network firewalls, which are mainly designed to protect ports and protocols.
Web Application Firewall is included with all Micron21 cloud hosting options. It can be deployed as an additional service for cloud server, cloud data centre, and physical server needs.
Micron21 Web Application Firewalls can protect against:
- Injection: SQL Injection Attacks use a web form or other mechanism to send SQL commands or commands containing SQL special characters. The attacker can then trigger the backend SQL database to execute the injected commands and allow unauthorised users to obtain sensitive information from a database.
- Cross-site scripting (XSS): XSS attacks exploit a web server that does not validate data coming from another site. XSS can enable attackers to obtain sensitive information, or to compromise a Web server.
- Sensitive data exposure: If web applications do not protect sensitive data (including credit card and social security numbers), attackers are able to conduct identity theft, credit card fraud, and other crimes.
- Cross-site request forgery (CSRF): CSRF attacks force a user to send an HTTP request, including the victim's session cookie, to a vulnerable web application. To the vulnerable web application, this appears to be a legitimate request coming from the victim.
Protect your website with a WAF from Micron21! contact us
Examples of attack mitigation.
The WAF module offers granular control of web application data flows. The WAF has various ways of dealing with threat vectors that can be launched at web applications. As two examples:
The WAF can prevent buffer overflow attacks by setting accepted maximum thresholds for aspects of HTTP requests, and blocking requests that exceed the configured limits.
The WAF can strip HTTP response headers to “cloak” server information that can equip a hacker to target an attack on your web servers. For example, the WAF can cloak an HTTP response header to hide the operating system that is running.
