Web Application Firewall (WAF)

This function uses a database of known attack patterns, or signatures, to identify and block malicious traffic. It compares incoming requests against a library of rules for common threats like SQL injection (SQLi) and cross-site scripting (XSS).

• How it works: Predefined regex patterns match known malicious payloads in request headers, parameters, or body content.
• Example: A rule might block any request containing the string pattern ' OR '1'='1.
• Limitation: It is ineffective against zero-day attacks or novel attack vectors not yet in its signature database.

Also known as behavioral or heuristic analysis, this function establishes a baseline of normal traffic for an application and flags deviations that may indicate an attack.

• How it works: The WAF learns typical request sizes, rates, URI structures, and parameter values. It then blocks requests that fall outside established statistical norms.
• Use Case: Effective at catching zero-day attacks, brute force attempts, and unusual traffic spikes that signatures might miss.
• Challenge: Requires a learning period and can generate false positives if the baseline is not accurately calibrated.

WAFs enforce security through two complementary policy models.

• Negative Security Model (Blacklist): The default mode. It blocks requests that match known bad patterns. It's efficient but reactive.
• Positive Security Model (Whitelist): A stricter mode. It only allows requests that match pre-approved patterns of good behavior (e.g., specific HTTP methods, parameter types, value lengths). This is highly effective but complex to implement and maintain.

Modern WAFs use a hybrid approach, applying a positive security model to critical application paths (like login or payment endpoints) and a negative model elsewhere.

This is a critical remediation function where a WAF provides an immediate, external security fix for a vulnerability in a web application before the underlying code can be patched by developers.

• How it works: When a new CVE is disclosed (e.g., a critical flaw in a CMS like WordPress), the WAF vendor rapidly deploys a rule to their cloud service or on-premises rule sets that blocks exploitation attempts.
• Benefit: It dramatically reduces the window of exposure, buying crucial time for development teams to test and deploy a permanent code fix without taking the application offline.

The WAF ensures that all incoming traffic conforms to web protocol standards, preventing attacks that exploit protocol ambiguities or violations.

• HTTP Validation: Enforces RFC standards for HTTP/1.1 and HTTP/2, checking for malformed headers, invalid character encodings, and illegal sequences.
• Size Limits: Imposes limits on request body size, URL length, and upload file sizes to prevent resource exhaustion attacks.
• Compliance: Helps meet regulatory requirements (like PCI DSS Requirement 6.6) by providing a dedicated application-layer security control that is regularly audited.

While distinct from volumetric network DDoS protection, a modern WAF includes capabilities to identify and manage malicious bot traffic aimed at the application layer.

• Bot Detection: Uses JavaScript challenges, CAPTCHAs, and fingerprinting to differentiate legitimate user traffic from automated scripts, credential stuffing bots, and scrapers.
• Application-Layer DDoS: Mitigates attacks like HTTP flood attacks that aim to exhaust application resources (e.g., spawning thousands of slow database queries per second).
• Integration: Often works in concert with a CDN and network-level DDoS protection services for a layered defense.

Zero-Trust Architecture (ZTA) is a security model founded on the principle of 'never trust, always verify.' It eliminates the concept of a trusted internal network, requiring strict identity verification for every user, device, and application flow attempting to access resources. A WAF is a key Policy Enforcement Point (PEP) within ZTA, applying granular access controls and threat inspection to all HTTP/HTTPS traffic, regardless of its source IP address. This moves security from the network perimeter to the individual application and API transaction level.

Runtime Application Self-Protection (RASP) is a security technology built directly into an application's runtime environment. Unlike a network-based WAF, which inspects traffic externally, RASP instruments the application from within to detect and block attacks by analyzing the app's behavior and context. It provides superior protection against business logic attacks and can see malicious payloads after decryption. A defense-in-depth strategy often employs both a WAF for perimeter-like filtering and RASP for internal, context-aware protection.

Distributed Denial-of-Service (DDoS) Protection involves mitigating large-scale attacks designed to overwhelm application infrastructure with traffic. While some modern WAFs include basic volumetric DDoS mitigation, dedicated DDoS protection services operate at the network (Layer 3/4) and application (Layer 7) levels using global scrubbing centers. They absorb attack traffic before it reaches the WAF. The WAF then handles more sophisticated, low-and-slow application-layer attacks that mimic legitimate traffic, creating a layered defense.