Web Application Firewall 101: How to Prevent Web Hacking

At this point, it's is safe to say that web hacking is a pretty rampant concern. It almost seems that on a weekly basis readers are inundated with major web hacking news that stymies a large corporation and its perceived cyber security defenses. However, there are many issues with reporting web attack news in this manner. To begin with, it primarily focuses on creating fear based news articles that really have no true value or lesson from these attacks. For example, reading about how a corporate giant lost over 300,000 customer user names and passwords surely does not instill any confidence or, better yet, makes us feel even more helpless. Secondly, these web hacking articles rarely discuss concrete ways to protect your own website from being hacked (other than run of the mill security "best practices" reminders). Readers are left with the sense that if major corporate brands can be infiltrated, then their information is as good as gone. But things shouldn't be this way! This is why it is critical to inspire discussion and help motivate those around you to take part in protecting their websites. One rather under represented form of website protection is implementing a web application firewall (WAF) into their web security profiles.

What is a Web Application Firewall (WAF) and What Does It Do?

Typically, there are various levels of communication in an IT system based on the Open Systems Interconnection (OSI) Model. More specifically, there are seven total layers of communication. One of the most highly targeted and sought after layers by web hackers is known as the Application layer (layer 7). This is not to be confused with software applications. Software applications, such as Microsoft Office Suite, are more productivity tools for end users to accomplish specified tasks. However, the term "Application" in this context is referring to web applications, which are programs that allow users to submit data and interact with webpages. Gone are the days when websites were just merely static pages. These days, most websites allow users to customize settings or directly communicate with a web server by filling out personalized forms, submitting online payments, or access webmail in order to increase user engagement. This is all done through the wonderful work of web applications.

The communication between web applications and a web server occurs on the Application layer. Thus, the ultimate transfer of user data through web applications is what makes this layer one of the most targeted and highly vulnerable layers of the OSI model. In fact, the Gartner group claims that nearly 70% of all web attacks occur at the Application layer, which proves that hackers are interested in targeting customer or sensitive data exploitation. As this trend continued to grow, web security specialists needed to devise an effective means of blocking web hackers from accessing such private information. As a result, web application firewalls were developed in order to help protect and filter out any malicious attacks toward the Application layer.

Next, it is important to note how a web application firewall functions. WAFs constantly monitor all inbound and outbound web traffic that is directed towards web applications or a web server in particular. By analyzing all HTTP traffic directed to a website, web application firewalls can effectively block web hackers, bots, or spam from reaching your website. If left unprotected, this can ultimately lead to dangerous and difficult to recover forms of attack, such as DDoS attacks, website defacement, or even sensitive data exploitation. The primary motive of a WAF is to ensure all malicious web traffic is filtered and only legitimate traffic is passed to your web server according to a set standard of rules and protocols.

Are All WAFs the Same?

Web application firewalls can differ in various ways. First, WAFs are available in hardware form, which typically require a dedicated security staff to help install and subsequently monitor the hardware usage. Although this is can be an expensive solution, it gives you or your online business the most comprehensive control over your own customizable web security environment. These days, many WAF vendors are offering cloud based versions of their application security solutions, which makes it a much more convenient and easy to use solution to help secure their websites.

In addition to the physical form of the web application firewall itself, WAFs can differ by their detection technology. The majority of web security vendors utilize what is known as pattern matching or signature based detection models as their sole detection method. This is a traditional form of protection where a web application firewall analyzes incoming web threats based on previous events or rules that occurred in the past. This effectively helps the WAF create an internal IP address white and black list to easily identify which attack source is exhibiting good or malicious behavior. However, this form of detection technology is simply outdated and can be quite ineffective against several forms of attack, such as zero day (the time between operating system, network, or even CMS updates security patches) exploits or more innovative web attacks.

The New Wave of WAF Detection Technology

In order to combat the ever changing world of cyber attacks, web application firewalls themselves had to become more intelligent. This need for more predictive and innovative technology spawned web security vendors to create logic analysis based web application firewall software. Next generation WAF vendors have started to implement a non-signature detection methodology that aims to analyze web traffic based on a litany of search parameters and detection rules. This can be a more effective means of identifying malicious web attacks with the ability to increase accuracy, provide lower false positive readings, and intelligently predict new and modified web attacks.

Understanding the intricacies of web hacking can be complicated and most major media publications do not do enough to raise awareness of cyber security. More specifically, they do not provide enough adequate or specific instructions on how to properly protect your website and personal data from being exploited. Whether you own an online business or have a casual website, it is important to ensure the protection of all personal or customer related data left on the site. In addition to following industry best practices to avoid web hacking (such as changing passwords often, avoiding suspicious email links, etc.), using a strong web application firewall can be the most effective way to safeguard the traffic that is redirected to your website. Get started today with proper website protection!

Joey Song is the Brand Manager at Cloudbric, an award winning cloud based web security solution. In his free time, he enjoys freelance writing about topics such as cyber security, web trends, and information security.