WAF 101 Flashcards
What benefits does WAF provide?
Web app security using layered rulesets enhanced with AI (machine-learning)
Analytics into new attacks (gain visibility into attacks, detect trends)
Protect against zero-day vulnerabilities using managed rulesets.
Defense against known attack types
Block credential stuffing and account takeover
Prevent data exfiltration
Advanced rate limiting (stops abusive traffic that can crash applications or APIs)
What is another word for “attacks”
Exploits
Some types of cyberattacks that WAF can protect from:
Cross-site scripting (XSS)
SQL Injection
Denial of service attacks (Rate Limiting) / (Layer 7)
Web scraping (Rate Limiting) / (Layer 7)
Brute Force (Rate Limiting) / (Layer 7)
How WAF works
The Cloudflare WAF inspects all traffic incoming to an application or website and blocks undesirable traffic based on rulesets.
What are basic concerns for customers needing WAF?
Businesses are concerned about the next unknown type of attack
Securing a multi-cloud environment
Reduce burden on IT teams
Why is securing a multi-cloud environment a concern for customers looking for a WAF vendor?
WAF apps cannot protect multiple apps in different environments AND a cloud provider cannot protect apps that exist outside of their cloud.
Explain the 3 main steps an internet request goes through WAF before entering customer’s network?
1) Traffic goes through Layer 7 DDoS protection
2) Traffic is scanned for known threats and possible new threats identified (through AI) on the entire Cloudflare network (new threats are given attack scores that can be applied to “rules”. CF Engineers are looking for & testing new exploits and update the ruleset for the entire network daily.
3 Traffic is scanned to apply customer’s custom rules (incl Rate Limiting)
if they have Advanced Bundle:
4) Exposed credential checks
5) Sensitive data prevention
WAF Pitches
“Cloudflare has built a fully integrated application security portfolio for a strong application security posture that protects applications from attacks and exploits, keeps APIs secure, stops bots, and mitigates risk from 3rd party dependencies in browsers. “
OR
“Comprehensive and effective application security requires a portfolio of capabilities that work together to provide layered security, including WAF, DDoS, bot management, and API security. Our integrated analytics and unified dashboard make us well-positioned to earn expanded app security business. “
How is CF WAF appealing to customers with little budget?
WAF Managed Rules are very appealing to customers with limited IT budgets, as they require very little configuration on the customer’s end.
Value Prop for Industry Trend:
Every year, the number of new vulnerabilities being discovered and disclosed is increasing dramatically – and this upward trend shows no signs of slowing down
Value Prop: WAF rules continuously updated by our security teams for protection before patches or updates are available.
WAF machine learning models help identify and block attackers that try to evade our WAF rules in order to exploit vulnerabilities
Value Prop for Industry Trend:
IT Teams have massive overhead
WAF Managed Rules are very appealing to customers with limited IT budgets, as they require very little configuration on the customer’s end.
Value Prop for Industry Trend:
APIs are the fastest growing data type, growing more than twice as fast as web traffic.
API Gateway is our primary API security product, but Advanced Rate Limiting also focuses on API-centric use cases.
Advanced Rate Limiting can throttle unexpected and unexplained surge in API traffic from a trusted source.
APIs and applications.
Gartner recognized Cloudflare as a Leader in the 2022 Gartner Magic Quadrant for Web Application and API Protection (WAAP) report.
Value Prop for Industry Trend:
Credential Stuffing
WAF monitors and blocks use of stolen/exposed credentials for account takeover.
What is WAF?
A Web Application Firewall (WAF) is a key defense used to protect internet apps. A WAF blocks malicious and undesirable traffic to an application or website.
Attacks that take advantage of these vulnerabilities are called “exploits.”
What is Layer 7 of OSI Model?
“Layer 7” refers to the Application Layer of the OSI model.
What is Rate Limiting?
its main function is to spot swells of abusive traffic, above and beyond what is normal, and block that traffic for a period of time to prevent web apps or APIs from being overwhelmed.
It does so by protecting website URLs and API endpoints from requests that exceed defined thresholds. Website and API visitors hitting defined request thresholds can trigger custom responses, such as mitigating actions (challenges or CAPTCHAS), response codes (Error 401 - Unauthorized), timeouts, and blocking.
Examples of this are like DDoS attacks, web scraping, and brute force attacks.
