WAF

Jan 1, 0001

Definition

A Web Application Firewall (WAF) is a security solution designed to protect web applications by monitoring and filtering HTTP/HTTPS traffic between a web application and the internet. It operates by applying a set of rules to an HTTP conversation, typically covering common attacks such as cross-site scripting (XSS), SQL injection, and other OWASP Top Ten threats. WAFs can be deployed as hardware appliances, software, or cloud-based services, and they provide an essential layer of defense in a comprehensive security strategy.

Secure Settings Example

# Example configuration for a cloud-based WAF
waf:
  rules:
    - id: 1
      name: SQLInjectionProtection
      action: block
      conditions:
        - type: SQLi
          match: true
    - id: 2
      name: XSSProtection
      action: block
      conditions:
        - type: XSS
          match: true
  logging:
    enabled: true
    logLevel: info
  defaultAction: allow
  ipWhitelist:
    - 192.168.1.1
    - 192.168.1.2

Insecure Settings Example

# Example of a misconfigured WAF
waf:
  rules:
    - id: 1
      name: SQLInjectionProtection
      action: allow # Incorrectly allowing SQL injection attempts
      conditions:
        - type: SQLi
          match: true
  logging:
    enabled: false # Logging disabled, reducing visibility into attacks
  defaultAction: allow
  ipWhitelist: [] # No IP whitelisting, increasing exposure to attacks