# WAF Solutions and API Security

**URL:** https://securesys.com.tr/en/services/waf-solutions-api-security

### Protect Your Web Applications and APIs Against Application Layer Attacks

Corporate applications no longer consist of classic web sites alone.

E-commerce systems, customer portals, mobile application backends, internet banking services, microservices and API-based applications have become organizations' critical assets exposed directly to the internet.

While a firewall controls network traffic, **WAF – Web Application Firewall** analyzes HTTP/HTTPS traffic at the application layer with the aim of detecting and blocking attacks against web applications and APIs.

Within SecureSys WAF Solutions we position the;

**F5 WAF / F5 Distributed Cloud WAAP Citrix NetScaler Web App Firewall Fortinet FortiWeb**

technologies according to organizations' application architecture, traffic volume, security requirements and data center/cloud structure.

### What Is WAF?

A Web Application Firewall is the security layer analyzing the HTTP and HTTPS traffic between the client and the web application.

The core architecture:

**Internet ↓ WAF ↓ Load Balancer / Reverse Proxy ↓ Web Application ↓ Database**

can be thought of in this way.

By examining incoming requests, WAF can block the traffic assessed as an attack before it reaches the application.

### What Is the Difference Between a Firewall and a WAF?

A firewall and a WAF are not the same technology.

#### Network Firewall

Focuses on IP, port, protocol, network session and network-level security policy.

#### Web Application Firewall

Analyzes HTTP/HTTPS request and response content at the application layer.

A firewall, for example, can make the;

443/TCP → Allowed

decision.

Inside the request sent over HTTPS, however, an SQL Injection payload such as;

' OR 1=1 --

may be present.

The WAF's job is to detect this attack attempt at the application layer.

### Which Attacks Does a WAF Protect Against?

Depending on product and configuration, modern WAF technologies can help detect a large number of web attacks.

Among these:

- SQL Injection – SQLi
- Cross-Site Scripting – XSS
- Command Injection
- Remote File Inclusion
- Local File Inclusion
- Path Traversal
- Protocol Manipulation
- Malicious File Upload
- HTTP Protocol Attacks
- Bot attacks
- Credential Stuffing
- Brute Force
- Web scraping
- API abuse
- Application-layer [DDoS](/en/services/ddos-test-service)

attacks of this kind can be present.

### OWASP Top 10 and WAF

One of the most important references in web application security is the **OWASP Top 10**.

WAF solutions can form an additional protection layer against many of the web application attacks defined by OWASP.

There is an important distinction, however:

**A WAF is not an alternative to secure software development or [penetration testing](/en/knowledge-base/what-is-penetration-testing).**

The correct approach;

**Secure Coding + SAST + DAST + Pentest + WAF + [SIEM](/en/services/siem-and-soar-security-service)/SOC**

is to build a multi-layered security architecture of this kind.

### Positive and Negative Security Models

WAF policy can generally use two core approaches.

#### Negative Security Model

Focuses on blocking known bad attack patterns.

**Known Attack → Detect → Block**

#### Positive Security Model

Focuses on defining the behavior permitted in the application.

**Expected Application Behavior → Allow Unexpected Behavior → Restrict**

Using the two approaches together on critical applications can provide stronger protection.

### Learning Mode

One of the most significant problems in WAF deployment is incorrect security policy blocking genuine user traffic.

Advanced WAF solutions can therefore offer mechanisms for learning the application's normal behavior.

For example, on the;

/login

endpoint, which HTTP methods, parameters and data types are normal can be analyzed over time.

The aim is to make security policy specific to the application.

### False Positive Management

One of the most critical matters determining the success of WAF projects is **False Positive** management.

An overly aggressive policy can produce the;

**More Security + More Incorrect Blocking**

result.

An overly loose policy, in turn, can allow real attacks to reach the application.

WAF deployment should therefore be carried out with the;

**Deploy → Learn → Tune → Test → Enforce → Monitor**

approach.

### What Is Virtual Patching?

One of the most important use cases of WAF is the **Virtual Patching** approach.

For example, a security vulnerability was detected in a critical web application during a penetration test.

Fixing the vulnerability will take the software team two weeks, however.

In this situation a temporary protection policy can be built on the WAF so the attack vector's reach into the application is restricted.

**Vulnerability Detected → WAF Rule → Virtual Patch → Development Fix → Retest**

This approach can reduce the risk window particularly on critical applications.

### Zero-Day Web Attacks

If signature-based security relies on known attack patterns alone, new attacks can be missed.

Modern WAF platforms can therefore make use of technologies such as;

**Behavior Analysis + Machine Learning + Threat Intelligence + Anomaly Detection**

and similar capabilities.

It should not be assumed, however, that any WAF will block every zero-day attack with complete certainty.

### API Security and WAF

A significant part of modern applications is API-based.

For example:

**Mobile App ↓ REST API ↓ Application ↓ Database**

Protecting web pages alone is therefore not enough.

WAF/WAAP platforms being able to understand API traffic as well is becoming steadily more critical.

### OWASP API Security Top 10

In API security, risks such as;

- Broken Object Level Authorization
- Broken Authentication
- Broken Object Property Level Authorization
- Unrestricted Resource Consumption
- Broken Function Level Authorization
- SSRF
- Security Misconfiguration

are important.

It should not be forgotten, however, that a WAF is not enough on its own in API security either.

Particularly in **BOLA/IDOR and business logic** vulnerabilities, the application's authorization logic needs designing securely.

### API Discovery

Organizations sometimes do not know all the API endpoints they hold.

Particularly in microservice and DevOps environments, the;

**Shadow API Zombie API Deprecated API Unknown API**

problems can emerge.

Modern WAAP solutions can help raise this visibility with API discovery and API security capabilities.

### Bot Management

Not all automated traffic is malicious.

Alongside legitimate crawlers such as Googlebot, there can be;

- Credential stuffing bots
- Scraping bots
- Account takeover bots
- Inventory abuse bots
- Fake account bots

these kinds of traffic.

In advanced WAF/WAAP architectures bot management has therefore become a separate security layer.

### Credential Stuffing

Attackers can try the;

**Username + Password**

combinations obtained from other data breaches on the organization's login screen through automated bots.

This attack differs from a classic brute-force attack because the usernames and passwords used may be real.

Risk can be reduced by using WAF, bot management and identity security technologies together.

### Layer 7 DDoS Protection

Network DDoS and Application Layer DDoS are not the same.

An attacker, for example, can try to consume the application's resources by sending a large number of requests to endpoints costly for the server such as;

GET /search

this kind of endpoint.

WAF/WAAP solutions can provide protection against Layer 7 attacks with mechanisms such as rate limiting and behavior analysis.

### WAF and SSL/TLS

Because the greater part of web traffic is carried over HTTPS, the TLS architecture needs designing correctly so the WAF can analyze HTTP content.

At this point, matters such as;

- SSL termination
- Certificate management
- TLS policy
- Cipher suites
- TLS versions
- Re-encryption

are part of the WAF project.

### Are a WAF and a Load Balancer the Same Thing?

No.

A **Load Balancer** manages the distribution of traffic between backend systems and application availability.

A **WAF** carries out the security analysis of application traffic.

Because vendors such as F5 and Citrix can offer load balancing and application delivery technologies together with WAF capabilities in the same architecture, however, the two concepts are frequently seen together.

### On-Premise WAF

An on-premise WAF is positioned in the organization's own data center.

It can be preferred particularly at organizations holding;

**Public Sector Defence Industry Finance Critical Infrastructure Data Sovereignty Requirements**

these requirements.

### Cloud WAF and WAAP

Modern applications no longer run in the corporate data center alone.

**Data Center + AWS + Azure + Google Cloud + Kubernetes + SaaS**

hybrid architectures of this kind have become widespread.

The classic WAF approach is therefore turning into the wider **WAAP – Web Application and API Protection** model.

WAAP generally brings capabilities such as;

**WAF + API Security + Bot Management + DDoS Protection**

together within a shared security approach.

### F5 Web Application Security

#### Enterprise WAF and WAAP

On the application security side F5 holds a broad product family, from classic WAF to cloud-native WAAP architectures.

On the F5 side, different approaches such as **BIG-IP Advanced WAF** and **F5 Distributed Cloud Web App & API Protection** can be assessed according to the project architecture.

#### F5 BIG-IP Advanced WAF

BIG-IP Advanced WAF can be positioned particularly in protecting data center and Enterprise applications.

It offers capabilities such as the detection of application layer attacks, bot protection, L7 DDoS security and advanced application security policy.

#### F5 Distributed Cloud WAAP

In cloud and hybrid application architectures the F5 Distributed Cloud approach brings the;

**Web Application Firewall + API Security + Bot Defense + DDoS Mitigation**

capabilities together under a WAAP architecture.

#### Who Is F5 Suitable For?

It can be assessed as a strong alternative particularly in;

**Enterprise + Finance + Telecom + Public Sector + High traffic volumes + Critical applications + Hybrid/Multi-Cloud**

these estates.

### Citrix NetScaler Web App Firewall

#### Application Delivery and WAF Security

NetScaler Web App Firewall offers application security capabilities for detecting and blocking Layer 7 attacks against web applications.

One of NetScaler's important positioning advantages is that **ADC + Load Balancing + Application Delivery + WAF** functions can be assessed within the same application delivery architecture.

#### Web Application Protection

NetScaler WAF analyzes HTTP/HTTPS traffic with the aim of preventing malicious requests against web applications from reaching the application server.

#### Positive Security

More controlled application security policy can be applied by defining the application's expected behavior.

#### Application Delivery

NetScaler;

**Load Balancing + SSL Offload + Application Delivery + WAF**

can be positioned particularly strongly in projects where these capabilities are needed together.

#### Who Is Citrix / NetScaler Suitable For?

It can be assessed particularly at Enterprise organizations wanting to manage;

**existing NetScaler ADC infrastructure + high availability + load balancing + application delivery + WAF**

these requirements on the same platform.

### Fortinet FortiWeb

#### Web Application and API Security

Fortinet FortiWeb is Fortinet's WAF platform for web application and API security.

FortiWeb offers a strong integration advantage particularly at organizations using the Fortinet Security Fabric.

#### Machine Learning Supported WAF

FortiWeb makes use of machine learning capabilities for analyzing application behavior and detecting abnormal requests.

This approach is valuable particularly in managing false positive rates and building application-specific security policy.

#### API Protection

Protecting modern REST APIs is one of FortiWeb's important use cases.

Application security policy can be applied to make API traffic visible and block malicious API requests.

#### Fortinet Security Fabric

FortiWeb;

**FortiGate + FortiSandbox + FortiClient + FortiAnalyzer + FortiSIEM**

can be included in a wider security architecture together with Fortinet security technologies of this kind.

For example, with the;

**FortiWeb → Suspicious File → FortiSandbox → Malicious Verdict**

integration, suspicious content uploaded over the web can be put through deeper analysis processes.

#### Who Is FortiWeb Suitable For?

It can be assessed as a strong option particularly for;

**Organizations using Fortinet + Web Application Security + API Protection + Security Fabric + On-Premise/Cloud application security**

these requirements.

### F5, Citrix NetScaler or FortiWeb?

Product selection should not be made on the brand alone.

**F5** is strong in estates holding broad Enterprise application delivery, WAF/WAAP, API and hybrid/multi-[cloud security](/en/services/cloud-services-penetration-testing-service) requirements.

**Citrix NetScaler** stands out in architectures where using ADC, load balancing, application delivery and WAF functions together matters.

**FortiWeb** is a strong alternative in estates where Fortinet Security Fabric integration, WAF and API security needs are present together.

### How Is a WAF POC Carried Out?

In SecureSys WAF projects we recommend carrying out a controlled POC before product selection.

Within the POC:

**\1. Application Discovery** The web applications and APIs to be protected are determined.

**\2. Traffic Analysis** Normal HTTP/HTTPS traffic is analyzed.

**\3. Learning Mode** The application's normal behavior is learned.

**\4. Attack Simulation** Controlled SQLi, XSS and other attack scenarios are carried out.

**\5. API Security** API endpoints and security policy are tested.

**\6. False Positive Test** Whether genuine user operations are being blocked incorrectly is examined.

**\7. Performance Test** Latency, throughput and SSL/TLS performance are assessed.

**\8. SIEM/SOC Integration** The transfer of WAF events to the security operations centre is verified.

**\9. Blocking Mode** Controlled blocking is applied once policy has been optimized.

### What Should You Consider When Choosing a WAF?

When choosing a WAF product we assess these criteria together:

- OWASP Top 10 protection
- API Security
- API Discovery
- Positive Security Model
- Negative Security Model
- Machine Learning
- Bot Management
- Credential Stuffing protection
- Layer 7 DDoS
- Rate Limiting
- Virtual Patching
- SSL/TLS performance
- False Positive management
- Threat Intelligence
- SIEM integration
- SOAR integration
- Sandbox integration
- High Availability
- Load Balancing requirement
- On-Premise / Cloud / Hybrid architecture
- Kubernetes and modern application support
- Central management
- Reporting
- Licensing model

### Does a WAF Replace Penetration Testing?

**No.**

A WAF does not remove the vulnerability; it helps prevent or hinder the exploitation of the attack.

If SQL Injection is present in the application, for example, the correct solution;

**Pentest → Vulnerability Detection → WAF Virtual Patch → Development Fix → Retest**

is this sequence.

Covering the vulnerability with a WAF and leaving the software-side security flaw open indefinitely is not a correct security approach.

### How Is WAF Pricing Determined?

WAF pricing can vary according to criteria such as;

- Traffic capacity
- Throughput
- Number of applications to be protected
- Number of APIs
- Appliance or virtual form
- Cloud usage model
- Bot Management
- DDoS capabilities
- SSL/TLS capacity
- High Availability
- Licence period
- Support level

and similar factors.

For correct WAF licensing, therefore, the application and traffic inventory needs establishing first.

### SecureSys WAF Solutions

In WAF projects SecureSys addresses not merely licence and device supply but the;

**Application Analysis → Architecture Design → Product Selection → Sizing → Demo / POC → Deployment → SSL/TLS Configuration → Learning → Policy Tuning → OWASP Tests → API Security → SIEM/SOC Integration → Operations & Support**

processes end to end.

We position the **F5, Citrix NetScaler and Fortinet FortiWeb** solutions according to the organization's existing infrastructure, traffic volume, application architecture and security requirements.

### If Your Application Is Open to the Internet, So Is Your Attack Surface

Web application and API security is not merely opening or closing port 443 on the firewall.

Real application security requires the real-time assessment of the questions;

**Who is the user? Which endpoint are they reaching? Is the request normal? Is it a bot? Does it contain SQL Injection? Is the API being abused? Is abnormal traffic forming?**

these questions.

With SecureSys WAF and WAAP Solutions, protect your web applications, APIs and internet services against OWASP-based attacks, bots and advanced application layer threats.

**Request a demo, POC and quote for F5, Citrix NetScaler and FortiWeb WAF**