WAF

Question 1

F5 discovery questions

Answer 1

• How important is it for you to have a predictable security budget?
• Have you ever calculated the costs associated with keeping/maintaining dedicated resources for configuring F5?

Question 2

WAF highlights (CLARC)

Answer 2

COMPLIANCE for PCI DSS requirement 6.6 — Cloudflare’s WAF enables you to cost-effectively fulfill PCI compliance

LIGHTNING-fast 0.3 ms processing times, with instant global updates

AUTOMATIC protection from diverse threats, with strong default rule sets and extensive customization providing Layer 7 protection that is fully integrated with DDoS mitigation

REAL-time reporting — robust logging lets you see what’s happening instantaneously

CLOUD deployment with no hardware, software or tuning required

Question 3

Selling point: a robust rules engine to customize your needs

Answer 3

Our WAF runs ModSecurity rule sets out of the box, protecting you against the most critical web application security flaws as identified by OWASP. It can also handle your existing rule sets and custom rules. Rules become effective in under 30 seconds.

Question 4

Selling point: cloud deployment plus DDoS mitigation and CDN

Answer 4

As a cloud-based service, Cloudflare’s WAF requires no hardware or software to install and maintain. Deploy the WAF with a single click, customizing it to meet your needs.

Its integration into the overall Cloudflare service means you get additional functionality for free. You can secure your website against DDoS attacks and use our global content delivery network to make it run faster.

Question 5

What does Cloudflare WAF protect against?

Answer 5

SQL injection, cross-site scripting (XSS), and zero-day attacks, including OWASP-identified vulnerabilities and threats targeting the application layer.

Question 6

What’s our WAF’s false positive rate?

Answer 6

1/50,000,000

Question 7

Restrict by IP/geolocation

Answer 7

Can blacklist/whitelist traffic from specific IP addresses or countries to protect against hackers from specific IPs or countries

Question 8

Virtual patching

Answer 8

Fixes a vulnerability before you patch your server or update your code, allowing you more time to patch and test updates.

Question 9

URL-specific custom rule sets

Answer 9

Allows you to include/exclude specific URLs or subdomains for WAF protection to test domains or include/ exclude specific subdomains

Question 10

PCI certification

Answer 10

Cloudflare’s service has received Level 1 service provider certification

Question 11

WAF settings

Answer 11

Block

Simulate (test for false positives)

Challenge (CAPTCHA)

Customizable block pages (customize page a visitor sees when they’re blocked) ENT only