What Is WAF?
Web Application Firewall (WAF) is an AI-based one-stop risk protection solution for web workload operations. It identifies malicious traffic through the AI and rule engines to protect website security and improve the security and reliability of websites.
WAF provides two types of cloud WAF, SaaS WAF and CLB WAF. The security protection capabilities provided by the two WAFs are basically the same, but the access methods are different.
- SaaS WAF resolves a domain name to the CNAME address provided by the WAF cluster through DNS and configures the origin server IP address through WAF. In this way, malicious traffic is cleansed and filtered, and normal traffic is forwarded to the origin server, protecting website security.
- CLB WAF integrates with the CLB cluster to copy the HTTP/HTTPS traffic of the CLB to the WAF cluster. WAF performs bypass threat detection and filtering, and synchronizes the trusted status of user requests to the CLB cluster for threat interception or allowance to protect website security.
WAF can effectively defend against OWASP attacks such as SQL injection, XSS cross-site scripting, trojan upload, and unauthorized access. In addition, it can effectively filter CC attacks, detect DNS linkage hijacking, provide zero-day vulnerability patches, and prevent webpage tampering to protect the website system and workload security in all aspects through various means.
Main Features
| Feature | Introduction |
|---|---|
| AI + WAF | AI and rule-based web attack identification prevents bypass attempts, ensures low false alarms and false positives, and provides effective defense against common web attacks such as SQL injection, unauthorized access, XSS, cross-site request forgery (CSRF), and WebShell Trojan upload, and other top 10 web security threats defined by OWASP. |
| Zero-day vulnerability virtual patching | The security team provides 24/7 monitoring, proactive discovery and response, and issues virtual patches for high-risk web vulnerabilities and zero-day vulnerabilities. Protected users can obtain protection capabilities against emergency vulnerability and zero-day vulnerability attacks without any operation, which greatly shortens the vulnerability response cycle. |
| Webpage anti-tampering | Users can configure core webpage content to be cached in the cloud and publish the cached webpage content externally. This ensures that even if the original page is tampered with, the cached content acts as a substitute, preventing negative impacts on the organization caused by webpage tampering. |
| Data leakage prevention | Prevent the background database from being stolen by hackers through server application hiding before events, intrusion protection during events, and sensitive data replacement and hiding after events. |
| CC attack protection | Intelligent CC protection integrates exception responses (timeout or response delay) of the origin server and big data analysis of website behaviors to generate defense policies with intelligent decision-making. Multi-dimensional and customizable precise access control, combined with countermeasures such as human-machine recognition and frequency control, effectively filters junk access and mitigates CC attacks. |
Why Do You Need WAF?
In the following scenarios, using WAF can effectively defend and prevent threats, ensuring the system and workload security of enterprise websites.
- Data leakage (core information asset leakage)
Websites serve as portals to many enterprise information assets. Hackers can steal enterprise information assets through web intrusions, causing immeasurable losses to enterprises. - Malicious access and data crawling (unable to provide normal services, data being used by opponents)
Hackers control the botnet to launch CC attacks on websites, exhausting resources and making it impossible to provide normal services. Malicious users use web crawlers to capture the core content of websites (comments in literary blogs, recruitment websites, forum websites, and e-commerce websites). Product details on e-commerce websites are deliberately crawled by competitors for research. Deal hunters try to search for information on low-priced products or obtain intelligence in advance of marketing promotions to find arbitrage possibilities. - Website WebShell attacks or tampering (impacting credibility and image)
After obtaining permissions of websites or servers, attackers insert malicious code to make users execute malicious programs, earn traffic, steal accounts, or show off. They implant links related to pornographic, gambling, and illegal content, and tamper with webpage images and text, causing a significant impact on website operation and damaging the image of website operators. The public credibility and image of the website suffer losses. - Framework vulnerability (attacked during patch fixing period)
Many web systems are based on common open-source frameworks such as Structs2, Spring, and WordPress. These frameworks often have security vulnerabilities, but the maintenance period of waiting for patches to be installed is a difficult and dangerous process. Many attacks will spread within one day after the vulnerability is announced.