What are WAF Rules?
Web application firewall (WAF) rules are a set of guidelines that dictate how a WAF analyzes web traffic and what actions it should take when it identifies suspicious activity. These rules tell the WAF what to look for in web traffic: certain characters, patterns, or headers, and what actions to take in response to finding these items: allow, block, or log.
What is a WAF?
To understand WAF rules, let’s first summarize what a WAF is. A Web Application Firewall (WAF) is a specialized security solution that shields a web application from the internet, safeguarding the server by detecting and blocking malicious HTTP and HTTPS traffic to and from a web service.
WAFs often function as reverse proxies between the internet and protected web applications. However, you can also deploy WAFs in various configurations, including inline, cloud-based, or on-premises, to suit specific security requirements. Regardless of the deployment method, a WAF inspects all incoming traffic before it reaches application servers, creating a protective shield against potential threats.
What are WAF Policies?
WAFs don’t protect against all types of threats and attacks; instead, they are one crucial element of a wider suite of tools used to protect websites and apps. WAFs operate based on policies that help it determine what traffic is deemed safe and what is malicious — in other words, what kind of traffic a WAF will allow or block.
Each company or person using a WAF can customize policies to their unique requirements. Policies can be updated quickly and even automatically. This is one of the advantages of a WAF: because policies can be modified easily, there can be a faster response to various types of attacks.
WAFs typically employ various detection approaches to enforce these policies:
Regular Expressions (Regex): Identify specific patterns within the traffic, enabling effective detection and blocking of malicious inputs.
Scoring Models: These models assign risk scores to incoming traffic based on predefined criteria. The WAF evaluates these scores to determine whether to allow, block, or further inspect the traffic, enabling a more nuanced response to potential threats.
SmartParse: This sophisticated method analyzes complex data structures within requests, helping to identify advanced attack patterns that might evade simpler detection techniques. It enhances the WAF's capability to detect and prevent sophisticated threats.
What are WAF Rules?
WAF rules are individual security guidelines within the broader WAF policies. A WAF policy contains multiple WAF rules. Policies, containing many rules, are then associated with a target web application where the policies ( and their rules) are to be applied.
You can think of the policy as an overarching “law” and rules as the verbiage and specifics of that law.
How do WAF rules work?
WAF rules have both conditions (what to look for in traffic requests) and actions (what to do if conditions in the rule are met). Think of this as if/then statements. A rule will define “if” this happens, “then” do this, for a WAF solution.
What are WAF rule conditions?
WAF rule conditions are the “if” portion of an if/then statement. The conditions define characteristics or patterns in web traffic that are suspicious. Typically, these include things like:
IP addresses or locations known for frequent malicious activity
Unexpected HTTP content types or methods
Unusual requests: both high rates of requests and suspicious timing
Certain keywords in the headers, body or URL of the request that are suspicious
What are WAF rule actions?
The “then” portion of an if/then statement, WAF rule actions are the activities the WAF performs when the “ifs” (conditions) above are identified. Actions typically include things like:
Alerting: Certain conditions prompt the WAF to notify named security people or teams of suspicious activity
Challenging: A user might be presented a CAPTCHA to ensure they are human (not a bot)
Logging: Suspicious activities may be ‘logged’ (recorded) so that security teams can review them in greater detail later
Blocking: A request may be blocked, preventing it from reaching the web application and accessing the system.
What are the different types of WAF rules?
There are three types of WAF rules:
Rate Limiting Rules: Rate limiting rules help keep the rate of requests flowing into a web application beneath a predetermined limit. This helps stop volumetric attacks like DDoS Attacks.
Managed Rule Sets: Managed rules are like ‘factory standards’- they are basic rules a WAF should always have. Think settings to identify and block OWASP Top 10 attacks. These rules are updated frequently as new guidance emerges.
Custom Rules: These are just as they sound. Custom rules that an organization can make specific to the threats and vulnerabilities most pressing for the org’s web applications.
Why are WAF rules important?
Having well-crafted WAF rules is a critical part of any security program. Having good rules in place helps:
Mitigate zero-day vulnerabilities
Enforce internal security policies and avoid unauthorized users from accessing an organization’s web applications
Protect against known and common web application attacks: cross site scripting, SQL Injection, etc.
Foster a layered security approach: with other powerful security measures in place, a robust set of rules is essential for a layered security program.
How Fastly can help
Fastly's Next-Gen WAF provides:
Comprehensive protection: Fastly detects and blocks the OWASP Top 10 web application vulnerabilities and custom threats you define through simple rules.
Rapid response times: With its global network of POPs, Fastly's Next-Gen WAF ensures ultra-low latency inspection for exceptional user experience, even during attacks.
Flexible configuration: You can customize rules, response pages, and more via Fastly's user-friendly interface without relying on lengthy change windows.
Real-time analytics: Thanks to Fastly's dashboard and API for proactive issue identification, you benefit from valuable insights into traffic and security events.
Seamless integration: Fastly's Next-Gen WAF works transparently with its CDN and edge computing services for unified security, performance, and delivery capabilities.
Learn more about how the Fastly Next-Gen WAF can provide advanced protection for your applications, APIs, and microservices with flexible deployment options and cutting-edge detection
Learn about Fastly Next-Gen WAF
