Call a Specialist Today! 800-886-5369

Web Application Firewall (WAF): Web Security Solution

Web Application Level SecurityWeb Application Level Security

Applications that provide services to end-users can be vulnerable to many threats. Although many of these threats can be prevented by application developers, this often is outside the web site owner's control. A Web Application Firewall (WAF) provides a layer of control between end-users and applications.

A WAF filters all application access, inspecting both the traffic towards the web application and the response tra c from the application. By securing both the application infrastructure as well as the application user, a WAF complements traditional network firewalls, which are not designed to protect at this granular level.

Threat Vectors

Applications can be vulnerable to many threats that are not detected by regular network firewalls. The impact of these attacks can be quite severe. The Open Web Application Security Project (OWASP) has compiled a list of the top 10 risks that still threaten many web application deployments. The top 10 of 2010 is virtually identical to the new 2013 version; the most common attacks have not changed dramatically over the years. Here are some examples:

Threat Vectors

A10 WAF and Security

Available on its A10 Thunder or AX Series ADCs without license fees, A10's WAF module has many features to protect organizations from the most common attacks, protecting applications from malicious traffic.

The WAF enables a full defense stack with other A10 security mechanisms in order to protect web applications, ensure against code vulnerabilities and prevent data leakage; this aids in regulatory security compliance, such as Payment Card Industry (PCI) Data Security Standard (DSS) requirements.

A10's WAF feature is designed to recognize many of today's threats, with  exibility to customize checks for emerging threats. The WAF is tightly integrated with other A10 security features within the Advanced Core Operating System (ACOS). Instead of integrating 3rd party WAF code, as many other vendors do, A10 has developed the WAF specifically for ACOS. This approach results in a highly scalable and high performance security solution which is simple to configure.

A10 WAF and Security

Attack Mitigation Examples

The WAF module offers granular control of Web application data flows. The WAF has various ways of dealing with threat vectors that can be launched at web applications.

Here are two use cases:

The A10 WAF module offers many more features, including:

Conclusion

With A10, organizations can attain peace of mind knowing their applications are protected from the most common attacks, especially those whose consequences can far exceed "common" consequences. A10 enables a full defense stack with WAF, DDoS protection, Application Access Management (AAM), SSL Intercept and more on its Thunder and AX Series appliances. All these features are designed for ACOS from the ground up and are fully integrated. A10 provides all these security features at no additional cost, as a single device solution.