Cyber Security Controls Demystified Part 3 - Web Application Firewall

In this episode, we break down what a Web Application Firewall (WAF) is, how it works and why it has become one of the most critical security technologies for protecting modern websites, web applications and APIs from increasingly sophisticated cyber threats. 

Duration: 0:11:20

Visit https://www.wecyberyou.com for more cyber security education, resources and awareness content like this. 

Thank you for listening. 
WeCyberYou! Team

Transcript

SPEAKER_00 0:00

Welcome in everybody. You are listening to the WeCyberU Unlocked podcast.

SPEAKER_01 0:04

Glad to be here.

SPEAKER_00 0:05

Yeah. And uh, real quick before we jump into today's deep dive, make sure you follow the channel so you never miss an update.

SPEAKER_01 0:11

Absolutely.

SPEAKER_00 0:12

And of course, you know, head over to weCyberU.com for more content just like this.

SPEAKER_01 0:15

Lots of good stuff there.

SPEAKER_00 0:16

For sure. So, okay, let's just get right into it. Today's mission is all about WFs.

SPEAKER_01 0:23

Right. Web application firewalls.

SPEAKER_00 0:25

Yeah, exactly. And we're going to unpack what a Wii F is, how it works, and really why it's basically this critical shield for the entire digital economy right now.

SPEAKER_01 0:34

Aaron Ross Powell Because I mean web apps are everywhere.

SPEAKER_00 0:36

Aaron Ross Powell Oh, totally. Online banking, social media, your company's sauce platforms. They're all just constantly exposed to the open internet.

SPEAKER_01 0:45

Trevor Burrus, Jr.: Constantly under attack.

SPEAKER_00 0:46

Trevor Burrus, Right. So okay, let's unpack this with an analogy. A traditional network firewall is sort of like a bouncer checking IDs at the door of a nightclub.

SPEAKER_01 0:56

Yeah, that's a good way to look at it.

SPEAKER_00 0:57

Trevor Burrus, Like they're only really looking at the outside, the IP addresses, ports, you know, the protocols.

SPEAKER_01 1:02

Trevor Burrus, Jr.: Making sure you have an ID.

SPEAKER_00 1:03

Trevor Burrus, Jr.: Exactly. But a wave, a waif is more like having an undercover security guard actually inside the club. Trevor Burrus, Jr.: Right.

SPEAKER_01 1:10

Mingling with the crowd.

SPEAKER_00 1:11

Trevor Burrus, Yeah. Watching what people are actually saying, what they're doing, their behavior.

SPEAKER_01 1:15

Trevor Burrus, Jr.: Which is a huge distinction because uh technically speaking, unlike those traditional firewalls, WEFs are operating at the application layer.

SPEAKER_00 1:23

Aaron Powell So that's layer seven, right, of the OSI model.

SPEAKER_01 1:25

Aaron Powell Spot on, layer seven. And that's crucial because it allows the WAF to actually inspect the real content of the HTTP and you know HTTPS web requests. Trevor Burrus, Jr.

SPEAKER_00 1:36

Before it even hits the server.

SPEAKER_01 1:37

Aaron Powell Exactly. It's looking at the actual responses and requests before the server has to deal with them.

SPEAKER_00 1:42

Aaron Powell Okay. So let's get into the how-to of that. What exactly is this undercover guard evaluating?

SPEAKER_01 1:47

Aaron Powell Oh man, it's looking at everything URLs, the headers, uh cookies, queries, strings.

SPEAKER_00 1:53

Forms, I'm guessing.

SPEAKER_01 1:54

Yep. Forms, API calls, any uploaded files, session info, even just like overall behavioral patterns.

SPEAKER_00 2:00

Aaron Powell Wow. Okay. So based on all that, the WMA makes a call.

SPEAKER_01 2:03

Right. It follows its rule set. So it might allow the request, it might block it, maybe challenge it with a cap DCHA.

SPEAKER_00 2:08

Aaron Powell Or just log it.

SPEAKER_01 2:09

Yeah, log it or rate limit it if it's suspicious but not overtly malicious.

SPEAKER_00 2:14

Aaron Powell But wait, let me push back on that for a second. Aaron Powell Sure.

SPEAKER_01 2:16

Go ahead.

SPEAKER_00 2:17

Because if a web request is really just mostly a string of text, how does the wave actually know that a specific text string is an attack?

SPEAKER_01 2:25

Aaron Powell Like how does it know it's not just normal user input?

SPEAKER_00 2:28

Right. Because I type weird stuff into search bars all the time.

SPEAKER_01 2:31

Aaron Powell Yeah. No, it's a great question. And it really speaks to how waifs have had to evolve.

SPEAKER_00 2:36

Okay.

SPEAKER_01 2:37

So first generation waifs, they relied almost completely on manual rules.

SPEAKER_00 2:41

Aaron Ross Powell Like hard-coded stuff.

SPEAKER_01 2:42

Aaron Ross Powell Yeah, what we call signature-based detection.

SPEAKER_00 2:45

Okay, got it.

SPEAKER_01 2:45

Trevor Burrus, it's highly accurate for known attacks. Like if a waif sees a very specific malicious script that causes uh cross-site scripting or XSS. Right. Or token manipulation that leads to cross-site request forgery. Exactly. Or patterns that look like a remote file inclusion, which can trigger remote code execution. That sounds bad. It's very bad. Or, you know, direct retraversal, where attackers literally just try to read sensitive server files by using dot dot slash patterns.

SPEAKER_00 3:15

Aaron Powell Oh, wow. So if it matches the signature, boom, it's blocked.

SPEAKER_01 3:19

Right. But the problem is it's completely blind to zero days. If it's a brand new attack, there's no signature.

SPEAKER_00 3:25

Ah, okay. So is this essentially the difference between having a VIP guest list and a do not fly list?

SPEAKER_01 3:33

That is, yeah, that's exactly what it is. Those are the two core security models.

SPEAKER_00 3:36

Aaron Powell Okay, break that down for me.

SPEAKER_01 3:37

So your VIP list is the positive security model. We also call it a whitelist.

SPEAKER_00 3:41

Gotcha.

SPEAKER_01 3:42

Only known, explicitly good traffic is allowed in. It's incredibly secure, but man, it requires intense tuning.

SPEAKER_00 3:49

Aaron Powell Because if you forget to put a good guy on the list, they're blocked.

SPEAKER_01 3:53

Exactly. Legitimate users get dropped all the time if it's not tuned perfectly.

SPEAKER_00 3:57

Right. And the other one?

SPEAKER_01 3:58

The negative security model, that's your blacklist, or the do not fly list.

SPEAKER_00 4:02

Okay.

SPEAKER_01 4:02

Known malicious patterns get blocked. It's way easier to deploy, but like we said, unknown attacks just slip right past it.

SPEAKER_00 4:09

Aaron Powell So obviously neither of those is perfect on its own.

SPEAKER_01 4:12

Aaron Powell No, not at all. And what's fascinating here is how we've upgraded. Modern waves don't just rely on lists anymore.

SPEAKER_00 4:20

They're smarter now.

SPEAKER_01 4:21

Much smarter. They use behavioral analysis to basically baseline what normal behavior looks like.

SPEAKER_00 4:28

Aaron Powell Like typical login rates or where the user is geographical.

SPEAKER_01 4:31

Aaron Ross Powell Exactly. And they use machine learning to detect emerging threats and fraudulent transactions based on anomalies in that baseline.

SPEAKER_00 4:39

Aaron Powell Okay. Here's where it gets really interesting to me, though.

SPEAKER_01 4:42

Yeah.

SPEAKER_00 4:42

Because we're talking about web pages, but what about mobile apps? Or modern software that doesn't even use a standard website.

SPEAKER_01 4:50

Aaron Powell Oh, that's the big shift. Aaron Powell Right.

SPEAKER_00 4:51

Because my banking app on my phone doesn't look or act like a normal web page to a server, does it?

SPEAKER_01 4:56

Aaron Powell No, not at all. And that is where API security comes into the picture.

SPEAKER_00 5:00

Aaron Powell Okay.

SPEAKER_01 5:00

Almost all modern apps run on REST or GraphQL APIs.

SPEAKER_00 5:04

Aaron Powell Basically just raw data streams, right?

SPEAKER_01 5:06

Aaron Ross Powell Exactly. And attackers love targeting APIs because they expose so much sensitive business logic and it's heavily, heavily automated.

SPEAKER_00 5:14

Aaron Powell So how does a modern WAF handle an API if it's not a web page?

SPEAKER_01 5:18

Aaron Powell It has to do things like API schema validation. It actually has to understand the structure of the JSON payload.

SPEAKER_00 5:25

Oh wow. So it's looking at the actual code structure. Trevor Burrus, Jr.

SPEAKER_01 5:27

Yeah, and doing deep token inspection. Plus, a huge part of modern WAFs is discovering shadow APIs.

SPEAKER_00 5:33

Aaron Powell Wait, shadow APIs.

SPEAKER_01 5:35

Yeah. Endpoints that developers spun up for testing, maybe forgot about and never told the security team about.

SPEAKER_00 5:41

Yikes. That sounds like a massive backdoor.

SPEAKER_01 5:43

It is. And connecting back to that automation piece, you have to realize a massive amount of internet traffic is just bots.

SPEAKER_00 5:50

Aaron Powell I mean, I know search engines use bots to index sites, right?

SPEAKER_01 5:53

Right. Googlebot is good. We want Googlebot. But a WAF has to identify and block the bad ones.

SPEAKER_00 5:59

Like what what are the bad ones doing?

SPEAKER_01 6:00

Aaron Ross Powell Malicious scrapers stealing content, uh credentials stuffing bots just hammering login pages with stolen passwords.

SPEAKER_00 6:08

Aaron Powell Oh, trying thousands of passwords a second.

SPEAKER_01 6:10

Aaron Powell Exactly. Or inventory hoarders. You know, when concert tickets sell out in two seconds.

SPEAKER_00 6:14

Yes. Oh my gosh, that is the worst.

SPEAKER_01 6:17

Bots. So the Warf has to use really advanced client fingerprinting and you know kept TCHA challenges to shut them down.

SPEAKER_00 6:25

Aaron Ross Powell Okay, so physically speaking, where is this all happening?

SPEAKER_01 6:28

Aaron Powell What do you mean?

SPEAKER_00 6:29

Like, are we talking about a big metal box sitting in a server room somewhere, or is this just code floating around the cloud?

SPEAKER_01 6:35

Oh, I see. Well, it depends. There are really four main deployment models for OAF.

SPEAKER_00 6:40

Okay, run through them for me.

SPEAKER_01 6:41

Sure. So first, you have cloud-based. Think of like Cloudflare or AWS.

SPEAKER_00 6:48

Oh, sure. Super common.

SPEAKER_01 6:49

Very common. It offers massive global coverage and it's easy to scale. Then you have the reverse proxy model, which sits in front of the web servers and does really deep inspection.

SPEAKER_00 6:58

Got it. What's the third one?

SPEAKER_01 6:59

Host-based. Something like mod security. It's installed directly on the web server itself.

SPEAKER_00 7:04

That sounds like it would give you a lot of control.

SPEAKER_01 7:06

Aaron Powell Very granular control, yeah. But the trade-off is it eats up your actual server resources, CPU, memory, all of that.

SPEAKER_00 7:13

Uh right. It competes with your actual app. And the last one.

SPEAKER_01 7:16

Hardware.

SPEAKER_00 7:17

Yeah.

SPEAKER_01 7:18

Literal data center appliances.

SPEAKER_00 7:20

Okay. The metal box.

SPEAKER_01 7:21

Yep. The metal box. Huge throughput, very fast, but definitely less flexibility than cloud models.

SPEAKER_00 7:28

Makes sense. Now let me ask about DDoS attacks. Because I feel like people confuse Wafus and DDoS protection all the time.

SPEAKER_01 7:35

Oh, constantly. It's a huge point of confusion.

SPEAKER_00 7:38

A WAF doesn't stop a massive DDoS attack, does it?

SPEAKER_01 7:40

Aaron Powell Well, it mitigates layer seven HTTP, and API floods the really complex application layer stuff.

SPEAKER_00 7:46

Aaron Powell But if someone just throws a terabyte of garbage traffic at your IP.

SPEAKER_01 7:50

Right. Massive volumetric DDoS attacks. A WAFE can't handle that alone. Your internet pipe will just choke.

SPEAKER_00 7:56

Aaron Powell So what do you do?

SPEAKER_01 7:58

You still need content delivery networks, CDNs, and dedicated scrubbing centers to absorb that kind of brute force.

SPEAKER_00 8:04

Aaron Powell Gotcha. Okay, I want to go back to something we touched on earlier. Sure. The tuning part. Because to me, it sounds a lot like an overzealous spam filter.

SPEAKER_01 8:12

Aaron Powell That's a great analogy, actually.

SPEAKER_00 8:14

Aaron Ross Powell Like if a user types something really weird in a search bar, maybe they're searching for code snippets. Couldn't the WAF just block them thinking it's a SQL injection?

SPEAKER_01 8:23

Yes. False positives are the main of every security engineer's existence.

SPEAKER_00 8:28

I bet.

SPEAKER_01 8:28

And that's why the WAF management lifecycle is so critical. You don't just turn it on and walk away.

SPEAKER_00 8:33

So what's the life cycle?

SPEAKER_01 8:34

You start with planning, obviously. But the big one is deployment in monitor mode.

SPEAKER_00 8:40

Monitor mode. Meaning it's watching but not acting.

SPEAKER_01 8:44

Exactly. It logs what it would have blocked, but lets the traffic through so you can see if it's breaking legitimate stuff.

SPEAKER_00 8:51

Oh, that's smart.

SPEAKER_01 8:52

Then you move into the tuning phase, fixing those false positives. And finally, it's just continuous improvement.

SPEAKER_00 8:59

Constant threat hunting, I assume.

SPEAKER_01 9:00

Yeah, because the threats never stop evolving, so your wave rules can't either. You have to constantly balance security with usability.

SPEAKER_00 9:08

Right. Because if your app is perfectly secure, but legitimate users can't buy anything, you're out of business anyway.

SPEAKER_01 9:15

Exactly. And you know, if we connect this to the bigger picture.

SPEAKER_00 9:18

Please do.

SPEAKER_01 9:18

A waif is not a silver bullet. I want to make that very clear.

SPEAKER_00 9:22

It's just one piece of the puzzle.

SPEAKER_01 9:24

Right. It absolutely cannot fix inherently insecure code. If your developers write bad code, the WAFA is just a band-aid. Organizations really must view it as one layer of a defense in-depth strategy.

SPEAKER_00 9:37

Makes total sense.

SPEAKER_01 9:38

And honestly, today, the platforms from the top vendors, you know, Cloudflare, Akamai, F5, Palo Alto Networks, Imperva.

SPEAKER_00 9:48

The big players.

SPEAKER_01 9:48

Yeah. They've evolved way beyond simple appliances. They're these unified application security platforms now.

SPEAKER_00 9:55

Encompassing all the stuff we talked about.

SPEAKER_01 9:57

Exactly. Bot management, API security, and all these zero trust capabilities built in.

SPEAKER_00 10:02

Wow. Okay. So what does this all mean for you, the listener?

SPEAKER_01 10:06

Aaron Powell Yeah. Why does it matter to the everyday user?

SPEAKER_00 10:08

Aaron Powell Well, as long as we rely on the cloud and mobile apps for literally everything, the WAF is really that foundational digital shield.

SPEAKER_01 10:16

It really is.

SPEAKER_00 10:16

It's the thing actively protecting your personal data, your finances, your privacy every time you tap a screen.

SPEAKER_01 10:23

Working quietly in the background.

SPEAKER_00 10:24

Exactly. But I want to leave you with a kind of provocative thought here. Based on something we brought up earlier.

SPEAKER_01 10:29

Oh, okay. Let's hear it.

SPEAKER_00 10:30

So modern wave is use machine learning to learn, you know, normal human behavior, right?

SPEAKER_01 10:35

Trevor Burrus, Right. The baseline we talked about.

SPEAKER_00 10:37

Aaron Powell But as attackers start using generative AI to perfectly mimic human browsing habits, like adding little pauses or erratic mouse movements.

SPEAKER_01 10:46

Oh, wow. Yeah.

SPEAKER_00 10:48

How will a WAF tell the difference? Like are we rapidly heading toward a future where our WAVs are literally just our AIs fighting their AIs in milliseconds?

SPEAKER_01 10:58

That is wow. That's kind of terrifying, but probably true.

SPEAKER_00 11:01

Aaron Powell Right. Just machines, fighting machines while we try to buy concert tickets.

SPEAKER_01 11:05

Yeah, that's a wild thought to end on.

SPEAKER_00 11:07

Yeah. Well, I think it's a good place to wrap up today's deep dive. Thank you so much for joining us, everyone.

SPEAKER_01 11:12

Thanks for having me.

SPEAKER_00 11:13

And remember, head over to waysyber you.com for more deep dives and definitely follow the WeCyberU unlocked podcast channel. We'll see you on the next one.