Web application firewalls (WAFs) are highly popular tools for securing IT assets. They provide protection by inspecting and filtering traffic between apps and the internet. They are known to be effective against cross-site scripting, cross-site request forgery, SQL injection, as well as file inclusion.
Senior DevOps Engineer Maksim Blishchik, however, suggests that WAFs already need to evolve to provide better protection. “After 20 years of using commercial web application firewall (WAF) products, it is time to acknowledge a hard truth: a traditional WAF no longer provides adequate protection for the modern internet user,” Blishchik declares.
Traditional WAFs no longer afford the right level of protection in the face of greater volumes and more sophisticated cyber-attacks. In the past, malicious bots were relatively simpler and easier to detect and prevent. Nowadays, the attacks WAFs have to deal with include state-sponsored campaigns that are not only persistent but also well-sustained and continuously enhanced.
The need to level up web application protection
Blishchik listed 10 challenges that make conventional WAF ineffective. These include the rapid evolution of web standards, the hardware bottleneck, the complexity of operating full-featured WAFs, inflexibility of most WAF products, incompatibility with the cloud environment, competitive disadvantage, lack of scalability, lack of context, and the lack of API support.
The lack of API support is particularly crucial given how prevalent applications are now with more devices getting connected to the internet. These are not just smartphones and tablet computers. The rise of the Internet of Things (IoT) has brought the number of web-connected devices to unprecedented levels.
One study projects that the total number of web-connected devices will have reached 46 billion by the end of 2021. Nearly 7 in every 10 of these are IoT devices. The total number of connected devices is expected to hit 125 billion by 2030. This means greater exposure to cyber threats with more devices requiring apps and APIs to serve their respective purposes.
Without proficient API support, web applications become easy targets for cybercriminals. This is alarming especially as an ESG study found that many organizations proceed with the release of their applications even with the knowledge that they contain vulnerabilities. This haste is mostly due to strict deadlines, the late discovery of the issues, and the determination that the vulnerabilities are low-risk.
Web Application and API Protection (WAAP)
The relatively new cybersecurity solution web application and API protection, or WAAP, came into being in 2019 as coined by Gartner analysts Jeremy D’Hoinne and Adam Hils in a research paper.
“Cloud web application and API protection services are the evolution of cloud web application firewall services, expanding scope and security depth. Security and risk management leaders must determine how cloud WAAP services will improve their security posture,” the Gartner research paper’s summary writes.
WAAP offers a host of new features to deal with new challenges and threats. One highlight feature is the possibility of adding different security modules. These modules address the limitations in scalability associated with conventional WAFs. It is also compatible with the multi-tenant cloud infrastructure commonly implemented at present. Having these modules means that it is possible to have varying depths of security to match varying needs. Additional service components may also be employed to bolster web application performance.
Additionally, WAAP is designed to provide the following capabilities:
- Runtime Application Self-Protection (RASP) – This is an emerging security technology designed to thwart cyberattacks by operating within an application’s runtime environment to provide real-time protection. It regulates the execution of applications, detection of vulnerabilities, and the prevention of attacks in real-time.
- Advanced WAF – Also referred to as next-gen WAF, this provides protection against a wide range of attacks by harnessing behavioral analysis and artificial intelligence. It can make automatic decisions regarding traffic and establishment security rules.
- Malicious bot protection – WAAP is capable of identifying safe from harmful or anomalous traffic to isolate and prevent bot-generated attacks.
- DDoS defense – In addition to bot protection, WAAP also has an effective system to address distributed denial-of-service especially at the application and network layers, shielding applications, microservices, and APIs from getting overwhelmed by unwanted traffic.
- Protection from account takeovers – WAAP is not only able to defend against bot-generated malicious traffic. It can also detect the unauthorized use of customer credentials particularly those attained through authentication APIs, customer-facing authentication processes, and the use of login details from password lists and data dumps sold by cybercriminals on the dark web.
- Application-level rate limiting – Through AI and behavioral analysis, WAAP can detect abusive activity at the application level to stop traffic that is adversely impacting the performance of a web service, website, or API.
- API and microservices – WAAP can provide protection within microservices, apps, as well as serverless functions to enable context-aware and data-driven perimeter defenses at the micro-level and in individual web services.
Correcting a false sense of security
Web application security is ideally achieved by getting rid of the issues at their source not just by hiding web apps from the threats. In a way, WAFs create a false sense of security, especially among organizations that do not understand the fundamentals of web application security and rely on the sales pitches of WAF solution providers.
However, it is equally important to highlight the potential issues that may be encountered in using WAAP. It is not some magic pill that eliminates all web application and API problems in an instant. There can be challenges in integrating WAAP solutions in the existing incident response workflow of an organization. Organizational data resiliency policies may also have to be revamped as WAAP is granted permission to decrypt TLS connections and access app secret keys and other sensitive data in the process.
As such, it is important to ascertain that the WAAP solution being considered matches the needs of an organization while ensuring adequate protection. It is preferable to choose WAAP services designed based on established WAF solutions since these tend to be more compatible with the enterprise ecosystem, particularly those that already have security information and event management (SIEM) and application security testing (AST) systems.
WAAP may also create a false sense of security if organizations only have a superficial understanding of it. If organizations only see WAAP as the better alternative to WAF, they will likely be picking solutions without being mindful of the compatibility with their existing system and the adequacy of the features and functions provided.
Advanced web application protection
Gone are the days when it is enough to rely on signature-based attack detection and port-based blocking to deal with malicious traffic. Even intrusion detection and prevention systems (IDS/IPS) have already been rendered ineffective as attackers exploit the complexity of HTTP traffic to hide malicious content. With a significant portion of web traffic employing TLS encryption, it also becomes necessary to scan encrypted traffic, something conventional WAF is incapable of doing.
More advanced web application protection through WAAP is a must for organizations to survive the cyber threats posed by more skilled and creatively malevolent bad actors. Web application and API protection are designed to be continuously self-learning to keep up with the rapidly evolving threat landscape at present.
