What are Web Application Firewalls (WAFs)?

Web Application Firewalls (WAFs) are server-side firewalls that protect externally-facing web applications. WAFs are part of a layered cybersecurity strategy. It falls to the WAF to prevent zero-day attacks on web apps and APIs that potentially reside in serverless architecture. WAFs can be deployed as a virtual or physical appliance.

Web application firewalls are specialized for securing web applications against specific kinds of threats, such as:

Cross-site scripting
SQL injection
Session hijacking
Denial of service
Buffer overflows

Other security tools, such as network firewalls, are less effective against these application-specific attacks. They may also come with more of a performance penalty than WAFs. Modern WAFs have also built out more live analytics and intelligent responsiveness to web traffic hitting an application. This allows them to better protect against zero-day attacks than legacy firewalls, which were wholly reliant on set policies for enforcing protection. In most cases, web application firewalls should be layered with other security tools, such as network firewalls or Runtime Application Self-Protection (RASP) software.

In 2006 the Payment Card Industry Data Security Standard (PCI DSS) mandated the protection of applications in production environments with web application firewalls or other devices that provide similar functionality. Since then, they have become a more standard tool in organization’s security tech stacks for securing any application.

Web Application Firewall (WAF) Features & Capabilities

WAFs generally present the following features:

Libraries of attack data based on known attacks to web applications
Monitoring, filtering and blocking of data and access to web applications
Automated attack detection, both identity-based (e.g. dynamic whitelisting, fingerprinting, risk scoring) and behavioral (e.g. risk scoring)
Advanced security techniques (e.g. deception/misdirection, virtual patch deployment, honeypot)
Zero-day attack prevention (related to the above)
A management interface with alert system
Reporting and analytics on threat and application usage

Web Application Firewall Comparison

Consider these factors when comparing web application firewalls:

Performance: How does each WAF impact the application’s performance? For instance, does each product introduce relevant latency in traffic? Do false positives create a worse application user experience?
Deployment Type: Should the WAF be deployed as a cloud-based app, an on-premise appliance, or as a server plugin? Each of these options impact latency, customizability, and scalability.
Integrations: Does each option integrate with the other application security tools already in use by the organization? This can dramatically impact how easy to maintain and update the WAF is in light of new vulnerabilities or attacks.

Start a web application firewall comparison here

Pricing Information

The cost of web application firewalls depends on deployment. There are three options:

A managed service or cloud-hosted WAF delivered as part of a subscription. This can be relatively low overhead as part of a larger subscription (e.g. part of a CDN). But it also may contain unneeded features.
A network-based appliance. This presents relatively high overhead but reduces latency because it is installed locally and close to the application.
A host-based WAF residing in the application’s code. This is rarer and may present less desirable computing costs and greater maintenance

Deployment Types	Software as a Service (SaaS), Cloud, or Web-Based
Operating Systems	Unspecified
Mobile Application	No

Distributed Cloud Services Demo

Cloudflare

IBM DataPower Gateway

Apigee Edge

Azure Application Gateway

Dynatrace

Imperva Web Application Firewall (WAF)

BIG-IP

AWS WAF

Salt Security API Protection Platform

Azure Front Door