Protect Your Web Applications and APIs Against Application Layer Attacks

Corporate applications no longer consist of classic web sites alone.

E-commerce systems, customer portals, mobile application backends, internet banking services, microservices and API-based applications have become organizations' critical assets exposed directly to the internet.

While a firewall controls network traffic, WAF – Web Application Firewall analyzes HTTP/HTTPS traffic at the application layer with the aim of detecting and blocking attacks against web applications and APIs.

Within SecureSys WAF Solutions we position the;

F5 WAF / F5 Distributed Cloud WAAP Citrix NetScaler Web App Firewall Fortinet FortiWeb

technologies according to organizations' application architecture, traffic volume, security requirements and data center/cloud structure.

What Is WAF?

A Web Application Firewall is the security layer analyzing the HTTP and HTTPS traffic between the client and the web application.

The core architecture:

Internet ↓ WAF ↓ Load Balancer / Reverse Proxy ↓ Web Application ↓ Database

can be thought of in this way.

By examining incoming requests, WAF can block the traffic assessed as an attack before it reaches the application.

What Is the Difference Between a Firewall and a WAF?

A firewall and a WAF are not the same technology.

Network Firewall

Focuses on IP, port, protocol, network session and network-level security policy.

Web Application Firewall

Analyzes HTTP/HTTPS request and response content at the application layer.

A firewall, for example, can make the;

443/TCP → Allowed

decision.

Inside the request sent over HTTPS, however, an SQL Injection payload such as;

' OR 1=1 --

may be present.

The WAF's job is to detect this attack attempt at the application layer.

Which Attacks Does a WAF Protect Against?

Depending on product and configuration, modern WAF technologies can help detect a large number of web attacks.

Among these:

SQL Injection – SQLi
Cross-Site Scripting – XSS
Command Injection
Remote File Inclusion
Local File Inclusion
Path Traversal
Protocol Manipulation
Malicious File Upload
HTTP Protocol Attacks
Bot attacks
Credential Stuffing
Brute Force
Web scraping
API abuse
Application-layer DDoS

attacks of this kind can be present.

OWASP Top 10 and WAF

One of the most important references in web application security is the OWASP Top 10.

WAF solutions can form an additional protection layer against many of the web application attacks defined by OWASP.

There is an important distinction, however:

A WAF is not an alternative to secure software development or penetration testing.

The correct approach;

Secure Coding + SAST + DAST + Pentest + WAF + SIEM/SOC

is to build a multi-layered security architecture of this kind.

Positive and Negative Security Models

WAF policy can generally use two core approaches.

Negative Security Model

Focuses on blocking known bad attack patterns.

Known Attack → Detect → Block

Positive Security Model

Focuses on defining the behavior permitted in the application.

Expected Application Behavior → Allow Unexpected Behavior → Restrict

Using the two approaches together on critical applications can provide stronger protection.

Learning Mode

One of the most significant problems in WAF deployment is incorrect security policy blocking genuine user traffic.

Advanced WAF solutions can therefore offer mechanisms for learning the application's normal behavior.

For example, on the;

/login

endpoint, which HTTP methods, parameters and data types are normal can be analyzed over time.

The aim is to make security policy specific to the application.

False Positive Management

One of the most critical matters determining the success of WAF projects is False Positive management.

An overly aggressive policy can produce the;

More Security + More Incorrect Blocking

result.

An overly loose policy, in turn, can allow real attacks to reach the application.

WAF deployment should therefore be carried out with the;

Deploy → Learn → Tune → Test → Enforce → Monitor

approach.

What Is Virtual Patching?

One of the most important use cases of WAF is the Virtual Patching approach.

For example, a security vulnerability was detected in a critical web application during a penetration test.

Fixing the vulnerability will take the software team two weeks, however.

In this situation a temporary protection policy can be built on the WAF so the attack vector's reach into the application is restricted.

Vulnerability Detected → WAF Rule → Virtual Patch → Development Fix → Retest

This approach can reduce the risk window particularly on critical applications.

Zero-Day Web Attacks

If signature-based security relies on known attack patterns alone, new attacks can be missed.

Modern WAF platforms can therefore make use of technologies such as;

Behavior Analysis + Machine Learning + Threat Intelligence + Anomaly Detection

and similar capabilities.

It should not be assumed, however, that any WAF will block every zero-day attack with complete certainty.

API Security and WAF

A significant part of modern applications is API-based.

For example:

Mobile App ↓ REST API ↓ Application ↓ Database

Protecting web pages alone is therefore not enough.

WAF/WAAP platforms being able to understand API traffic as well is becoming steadily more critical.

OWASP API Security Top 10

In API security, risks such as;

Broken Object Level Authorization
Broken Authentication
Broken Object Property Level Authorization
Unrestricted Resource Consumption
Broken Function Level Authorization
SSRF
Security Misconfiguration

are important.

It should not be forgotten, however, that a WAF is not enough on its own in API security either.

Particularly in BOLA/IDOR and business logic vulnerabilities, the application's authorization logic needs designing securely.

API Discovery

Organizations sometimes do not know all the API endpoints they hold.

Particularly in microservice and DevOps environments, the;

Shadow API Zombie API Deprecated API Unknown API

problems can emerge.

Modern WAAP solutions can help raise this visibility with API discovery and API security capabilities.

Bot Management

Not all automated traffic is malicious.

Alongside legitimate crawlers such as Googlebot, there can be;

Credential stuffing bots
Scraping bots
Account takeover bots
Inventory abuse bots
Fake account bots

these kinds of traffic.

In advanced WAF/WAAP architectures bot management has therefore become a separate security layer.

Credential Stuffing

Attackers can try the;

Username + Password

combinations obtained from other data breaches on the organization's login screen through automated bots.

This attack differs from a classic brute-force attack because the usernames and passwords used may be real.

Risk can be reduced by using WAF, bot management and identity security technologies together.

Layer 7 DDoS Protection

Network DDoS and Application Layer DDoS are not the same.

An attacker, for example, can try to consume the application's resources by sending a large number of requests to endpoints costly for the server such as;

GET /search

this kind of endpoint.

WAF/WAAP solutions can provide protection against Layer 7 attacks with mechanisms such as rate limiting and behavior analysis.

WAF and SSL/TLS

Because the greater part of web traffic is carried over HTTPS, the TLS architecture needs designing correctly so the WAF can analyze HTTP content.

At this point, matters such as;

SSL termination
Certificate management
TLS policy
Cipher suites
TLS versions
Re-encryption

are part of the WAF project.

Are a WAF and a Load Balancer the Same Thing?

No.

A Load Balancer manages the distribution of traffic between backend systems and application availability.

A WAF carries out the security analysis of application traffic.

Because vendors such as F5 and Citrix can offer load balancing and application delivery technologies together with WAF capabilities in the same architecture, however, the two concepts are frequently seen together.

On-Premise WAF

An on-premise WAF is positioned in the organization's own data center.

It can be preferred particularly at organizations holding;

Public Sector Defence Industry Finance Critical Infrastructure Data Sovereignty Requirements

these requirements.

Cloud WAF and WAAP

Modern applications no longer run in the corporate data center alone.

Data Center + AWS + Azure + Google Cloud + Kubernetes + SaaS

hybrid architectures of this kind have become widespread.

The classic WAF approach is therefore turning into the wider WAAP – Web Application and API Protection model.

WAAP generally brings capabilities such as;

WAF + API Security + Bot Management + DDoS Protection

together within a shared security approach.

F5 Web Application Security

Enterprise WAF and WAAP

On the application security side F5 holds a broad product family, from classic WAF to cloud-native WAAP architectures.

On the F5 side, different approaches such as BIG-IP Advanced WAF and F5 Distributed Cloud Web App & API Protection can be assessed according to the project architecture.

F5 BIG-IP Advanced WAF

BIG-IP Advanced WAF can be positioned particularly in protecting data center and Enterprise applications.

It offers capabilities such as the detection of application layer attacks, bot protection, L7 DDoS security and advanced application security policy.

F5 Distributed Cloud WAAP

In cloud and hybrid application architectures the F5 Distributed Cloud approach brings the;

Web Application Firewall + API Security + Bot Defense + DDoS Mitigation

capabilities together under a WAAP architecture.

Who Is F5 Suitable For?

It can be assessed as a strong alternative particularly in;

Enterprise + Finance + Telecom + Public Sector + High traffic volumes + Critical applications + Hybrid/Multi-Cloud

these estates.

Citrix NetScaler Web App Firewall

Application Delivery and WAF Security

NetScaler Web App Firewall offers application security capabilities for detecting and blocking Layer 7 attacks against web applications.

One of NetScaler's important positioning advantages is that ADC + Load Balancing + Application Delivery + WAF functions can be assessed within the same application delivery architecture.

Web Application Protection

NetScaler WAF analyzes HTTP/HTTPS traffic with the aim of preventing malicious requests against web applications from reaching the application server.

Positive Security

More controlled application security policy can be applied by defining the application's expected behavior.

Application Delivery

NetScaler;

Load Balancing + SSL Offload + Application Delivery + WAF

can be positioned particularly strongly in projects where these capabilities are needed together.

Who Is Citrix / NetScaler Suitable For?

It can be assessed particularly at Enterprise organizations wanting to manage;

existing NetScaler ADC infrastructure + high availability + load balancing + application delivery + WAF

these requirements on the same platform.

Fortinet FortiWeb

Web Application and API Security

Fortinet FortiWeb is Fortinet's WAF platform for web application and API security.

FortiWeb offers a strong integration advantage particularly at organizations using the Fortinet Security Fabric.

Machine Learning Supported WAF

FortiWeb makes use of machine learning capabilities for analyzing application behavior and detecting abnormal requests.

This approach is valuable particularly in managing false positive rates and building application-specific security policy.

API Protection

Protecting modern REST APIs is one of FortiWeb's important use cases.

Application security policy can be applied to make API traffic visible and block malicious API requests.

Fortinet Security Fabric

FortiWeb;

FortiGate + FortiSandbox + FortiClient + FortiAnalyzer + FortiSIEM

can be included in a wider security architecture together with Fortinet security technologies of this kind.

For example, with the;

FortiWeb → Suspicious File → FortiSandbox → Malicious Verdict

integration, suspicious content uploaded over the web can be put through deeper analysis processes.

Who Is FortiWeb Suitable For?

It can be assessed as a strong option particularly for;

Organizations using Fortinet + Web Application Security + API Protection + Security Fabric + On-Premise/Cloud application security

these requirements.

F5, Citrix NetScaler or FortiWeb?

Product selection should not be made on the brand alone.

F5 is strong in estates holding broad Enterprise application delivery, WAF/WAAP, API and hybrid/multi-cloud security requirements.

Citrix NetScaler stands out in architectures where using ADC, load balancing, application delivery and WAF functions together matters.

FortiWeb is a strong alternative in estates where Fortinet Security Fabric integration, WAF and API security needs are present together.

How Is a WAF POC Carried Out?

In SecureSys WAF projects we recommend carrying out a controlled POC before product selection.

Within the POC:

1. Application Discovery The web applications and APIs to be protected are determined.

2. Traffic Analysis Normal HTTP/HTTPS traffic is analyzed.

3. Learning Mode The application's normal behavior is learned.

4. Attack Simulation Controlled SQLi, XSS and other attack scenarios are carried out.

5. API Security API endpoints and security policy are tested.

6. False Positive Test Whether genuine user operations are being blocked incorrectly is examined.

7. Performance Test Latency, throughput and SSL/TLS performance are assessed.

8. SIEM/SOC Integration The transfer of WAF events to the security operations centre is verified.

9. Blocking Mode Controlled blocking is applied once policy has been optimized.

What Should You Consider When Choosing a WAF?

When choosing a WAF product we assess these criteria together:

OWASP Top 10 protection
API Security
API Discovery
Positive Security Model
Negative Security Model
Machine Learning
Bot Management
Credential Stuffing protection
Layer 7 DDoS
Rate Limiting
Virtual Patching
SSL/TLS performance
False Positive management
Threat Intelligence
SIEM integration
SOAR integration
Sandbox integration
High Availability
Load Balancing requirement
On-Premise / Cloud / Hybrid architecture
Kubernetes and modern application support
Central management
Reporting
Licensing model

Does a WAF Replace Penetration Testing?

No.

A WAF does not remove the vulnerability; it helps prevent or hinder the exploitation of the attack.

If SQL Injection is present in the application, for example, the correct solution;

Pentest → Vulnerability Detection → WAF Virtual Patch → Development Fix → Retest

is this sequence.

Covering the vulnerability with a WAF and leaving the software-side security flaw open indefinitely is not a correct security approach.

How Is WAF Pricing Determined?

WAF pricing can vary according to criteria such as;

Traffic capacity
Throughput
Number of applications to be protected
Number of APIs
Appliance or virtual form
Cloud usage model
Bot Management
DDoS capabilities
SSL/TLS capacity
High Availability
Licence period
Support level

and similar factors.

For correct WAF licensing, therefore, the application and traffic inventory needs establishing first.

SecureSys WAF Solutions

In WAF projects SecureSys addresses not merely licence and device supply but the;

Application Analysis → Architecture Design → Product Selection → Sizing → Demo / POC → Deployment → SSL/TLS Configuration → Learning → Policy Tuning → OWASP Tests → API Security → SIEM/SOC Integration → Operations & Support

processes end to end.

We position the F5, Citrix NetScaler and Fortinet FortiWeb solutions according to the organization's existing infrastructure, traffic volume, application architecture and security requirements.

If Your Application Is Open to the Internet, So Is Your Attack Surface

Web application and API security is not merely opening or closing port 443 on the firewall.

Real application security requires the real-time assessment of the questions;

Who is the user? Which endpoint are they reaching? Is the request normal? Is it a bot? Does it contain SQL Injection? Is the API being abused? Is abnormal traffic forming?

these questions.

With SecureSys WAF and WAAP Solutions, protect your web applications, APIs and internet services against OWASP-based attacks, bots and advanced application layer threats.

Request a demo, POC and quote for F5, Citrix NetScaler and FortiWeb WAF

WAF Solutions and API Security