At Fortra’s Alert Logic, we frequently hear from people who believe tuning an inline web application firewall (WAF) effectively protects their web applications without blocking legitimate traffic is challenging.
While a web application firewall does bring some unique challenges, if you understand the issues and work to overcome them, the faster you’ll be able to use your WAF as intended – to protect your valuable web applications and data. Here are a few thoughts and suggestions on WAF tuning.
Being a WAF Expert Requires Unique Skills
You need to have a deep understanding of your web applications and security and your WAF. Breaking it down a bit further, it means you should understand the application stack, know about security challenges like spoofing, fraud, DOS attacks and more, and have the knowledge and skill for writing policies for your web application firewall that protect your applications. It’s not easy to find all those skills in a single person, so you should plan to give your WAF specialist time to become an expert or augment your specialist with help to at least get started.
WAF Tuning Is a Constant Requirement
In the world of web application firewalls, two things are always changing: your web apps and the cyber threat landscape. That means you need to be constantly tuning your WAF to address both situations. One suggestion for dealing with web application changes is to run your WAF in your pre-production test environment. Run your web application firewall in learning mode there so it can understand your web application’s changing behavior and when you’re ready to flip to production, your web application firewall should already be well-tuned. In terms of keeping up with emerging threats, there are many websites and sources for information, including Alert Logic’s website.
A WAF Brings Development & Security Teams Together
And those teams often have conflicting priorities. Development teams are typically pressured to deliver product to market with as many features as possible as fast as possible. IT security teams, on the other hand, are pressured to ensure the IT environment and the business are safe. The best advice is the same as what works in many team situations … the more awareness each team has about the other, their mandates, and why their mandates are important to the business, the easier it is for them to figure out ways to effectively work together.
Additional Resources:
- Blog: What is a WAF?
- Blog: Web App Security: Insights from the Frontline
- Solution Brief: Managed Web Application Firewall
