Table of Contents
You invested significant time and money into those custom web applications connecting your business systems to internal and external users. Maybe you built a slick single page app for customers or an API-driven mobile platform for your field reps. Whatever the case, you need rock solid protection against attacks aimed at exploiting vulnerabilities in those web apps.
As your web security guru, I put together this comprehensive guide on advanced tools called web application firewalls designed specifically to lock down web apps. I‘ll explain how WAFs work, provide updated data on the relentless threats attacking your web apps, evaluate numerous solutions, and give you my recommendations tailored to your business requirements.
Web App Attacks: By the Numbers
Before we dive into the tools to protect web apps, you should understand the sheer volume and growth trajectory of attacks targeting these internet-facing assets.
According to Akamai research, web app attacks increased by 341% from 2019 to 2020. Likewise, Imperva found SQL injection tripled in the past year. The 2022 Verizon DBIR attributed 43% of breaches to web app exploits.
Why this spike in hackers zeroing in on web apps? Two reasons:
-
The digital shift during the pandemic placed web and mobile apps front and center for engagement, commerce, and operations. More web apps means a larger attack surface.
-
Web apps tend to be highly complex, often sporting vulnerabilities that give hackers a doorway into backend systems and data assets prized on the dark web.
These concerning trends and seven-figure breach costs underscore why securing web apps needs to be a top priority for your security roadmap.
Now let‘s explore purpose-built solutions called web application firewalls that establishment firewalls and endpoint security tools are ill-equipped to provide…
What Are Web Application Firewalls?
Think of web application firewalls (WAF) like a bouncer at an exclusive club, allowing legitimate patrons access while keeping the riff-raff out.
You define strict policies enforced by the WAF to analyze all web traffic destined for your apps hosted on public cloud, private cloud, hybrid cloud, or on-prem infrastructure. Using rules, threat intelligence feeds, machine learning, etc. the WAF blocks SQL injections, cross-site scripting attempts, unauthorized bots, API attacks and other known threats before they reach vulnerable web apps:
Advanced WAFs combine positive and negative security models for maximum accuracy separating safe vs. malicious visitors to your web properties.
Let‘s examine the WAF landscape to understand your protection options…
Web Application Firewall Vendor Landscape
There are over 25 significant WAF providers with products spanning cloud-based, on-premise appliance, virtual appliance, and hybrid deployment options.
I track this market closely to advise clients like yourself. Heavyweights include Imperva, F5 Networks, Cloudflare, Akamai, and AWS. However, exciting next gen startups like Signal Sciences, Wallarm, and Protegrity are disrupting with innovative application-layer security models.
Forrester divides vendors into pure-play WAF providers or broad network security players that add WAF modules to existing firewalls and web gateways.
Meanwhile Gartner groups WAF competitors into Leaders, Visionaries, Niche Players and Challengers based on capabilities and track record.
No matter which quadrant they land in, the 12 WAF solutions below rise to the top across analyst coverage, verified reviews, and buyer satisfaction surveys:
| Cloudflare | Akamai | Imperva | F5 Networks | Fortinet | Radware |
| Citrix | Barracuda | AWS WAF | Sucuri | Signal Sciences | Wallarm |
Now let‘s go deeper comparing the security efficacy, flexibility, and cost models of the top players that analysts place in the "Leaders" segment…
Cloudflare Web Application Firewall
Deployments: Cloud-based, hybrid, on-prem
Pricing: Starts at $20/month
Pros
- Blazing fast threat recognition and mitigation leveraging global network
- Top-tier bot management and IP reputation intelligence
- Easy WAF policies configuration
- Scales on demand for personal sites to enterprise
Cons
- Can get pricey for larger customers
- Limited application layer defenses compared to Imperva
Cloudflare WAF is my choice for lean IT teams lacking security expertise given its fast setup, intuitive controls, and built-in DDoS absorption. Mid-market ecommerce sites also thrive with Cloudflare by offloading security to their infrastructure.
Imperva SecureSphere WAF
Deployments: Cloud, on-premises, hybrid
Pricing: Quoted based on services
Pros:
- Over 4000 security rules including coverage for emerging threats
- Sophisticated bot classification and fingerprinting
- Low false positive rates thanks to workflow automation
- Fully managed WAF service option
- Integrates attack data with Imperva WAAP platform
Cons
- Complex setup and management
- Premium pricing for a la carte services
With the largest WAF rule base and specialized bot expertise, Imperva SecureSphere shines for regulated industries like financial services and healthcare needing to comply with data security mandates.
Akamai Kona Web Application Firewall
Deployments: Cloud and on-prem configurations
Pricing: Unique quote based on use case
Pros:
- Leverages expansive Akamai content delivery network
- Precision policies customized using real production traffic
- Elite DDoS scrubbing and traffic control capacities
- Tight integration with Akamai web protection suite
Cons:
- Premium customer support requires special contracts
- Rule creation less intuitive than some rivals
With unique visibility into 40% of the world’s web traffic, Akamai’s threat research and rapid signature propagation allow them to quickly stamp out attacks spreading in the wild.
I suggest Akamai Kona WAF for mid-large enterprises heavily reliant on web presence and ecommerce revenue.
Key Considerations When Selecting a WAF
While the above solutions lead in market share and analyst rankings, identifying the optimal web application firewall strategy for your organization takes careful evaluation across 10 aspects:
Your deployment method – For hybrid or multi-cloud environments, a cloud-based WAF may simplify securing web apps in different infrastructures. Performance-sensitive sites serving substantial traffic often deploy a local on-premise WAF appliance.
Detection accuracy – The ability to flag benign vs. malicious traffic with minimal false positives is paramount. Look for threat feeds, machine learning, device fingerprinting, negative model detection in addition to signature-based detection for maximum accuracy.
Breadth of coverage – OWASP Top 10 is just the tip of the iceburg. Prioritize PCI, CSRF protections, API attack defenses, schema poisoning detection, bot mitigation, and zero day learning capabilities.
Rule customization – Adding new rules to block the latest threats or fine tune for your specific apps is vital for secure policies over time. Require a library of 3000+ rules to start.
Action options – When threats arise,支持可选的 does the WAF allow rate limiting, redirecting to quarantined landing pages, or outright blocking? Order of actions should adjust based on risk profile.
Ease of deployment – Whether utilizing turnkey cloud WAF or installing virtual/hardware appliances, you want security team time spent creating policies – not wrestling with setup issues.
Ease of management – Day 2 workload dealing with updates, monitoring alerts, adding new apps, and generating compliance reports should not become a costly distraction because of tool complexity.
Scalability – Even if starting small, you need horizontal and vertical scale potential to absorb exponential traffic increases and new app integrations without huge price hikes.
Reporting – Can the solution generate heat maps showing highest risk vulnerabilities? Are attack forensics insightful for pinpointing root causes? Reporting should provide actionable metrics to continually optimize WAF rule sets.
Vendor support competency – Despite best efforts, you may encounter an attack or integration complication requiring vendor escalation. Measure response times, expertise and customer satisfaction with support interactions.
WAF Recommendations By Industry
The right WAF depends entirely on your apps, infrastructure, risk tolerance and other unique criteria. While I advise testing shortlisted options with real production traffic, here are WAF implementations I would suggest based on your core business:
Small Business – A managed Cloud WAF like Cloudflare or Azure WAF allows leaning on vendor security competence rather than developing in-house skills. Price and ease-of-use are big plusses.
Retail – Akamai and Imperva boast specialized policies for web scraping attacks plaguing ecommerce. Bot management and always-on availability during sales events are retail WAF must-haves.
Finance – Heavily regulated finance apps demand WAFs like Imperva that tick compliance boxes out-of-the-box while allowing security analysts to tweak rule sensitivity.
Technology – API and microservices-heavy properties should shortlist Signal Sciences for smart runtime app monitoring and Wallarm for its DevSecOps-ready WAF integrating with native code analyzers.
Healthcare – Strict data handling mandates push healthcare organizations toward managed WAF offerings from Rackspace, Verizon, and AWS which own compliance burdens.
The consequences of deferring WAF deployment range from denied service and site defacement all the way to compromised patient records or stolen financial assets. I encourage moving WAF evaluations forward now before your web apps end up regulatory scrutiny or tabloid headlines.
I hope mapping the WAF landscape and priorities for review makes your security team’s decision process easier. Feel free to reach out if you need a second set of eyes when assessing options or designing infrastructure for your freshly fortified web apps.
Stay safe out there!