WAF is dead - long live WAAP

How does WAAP actually work?

Application firewalls work on layer 7 of the OSI model and can intercept numerous threats such as injections, cross-site scripting (XSS) and other attacks. Protection is therefore provided for the server application and its data, not the browser or device accessing it. From a technical perspective, it is usually a reverse proxy that breaks open the encrypted (HTTPS) connection, controls the data flow in both directions and changes it if necessary. Alternatively, the protection functions are embedded in the application; this variant is called Runtime Application Self Protection (RASP) and is less common because integration into the application is significantly more complex.

A variety of protection mechanisms are used to prevent the different types of attack:

• Negative security filters: Block lists are used to detect and block suspicious patterns and known types of attack such as cross-site scripting or injection attacks.
• Positive security filters: The best security is achieved if you know exactly what the application expects. These filter rules block everything that is not explicitly permitted. Such a white list can be created using a learning mode. In the case of APIs, an existing interface specification can be used for this.
• Authentication and access control: The attack surface can be significantly reduced if only authorized users can access the application. In cooperation with an identity provider, each user is authenticated in advance. This means that an attacker without valid access cannot even search for vulnerabilities.
• Rate limiting & quotas: By limiting the throughput, brute force attacks or content scraping can be made more difficult. Ideally, these limits are dependent on the identity of the call, especially when calling APIs.
• Anomaly detection: Artificial intelligence can be used to detect conspicuous deviations from “normal” user behavior. If there is a suspicion that an unwanted bot is at work, a new login or a captcha can be requested.
• Threat Intelligence: Some users may be less trustworthy simply because of their location or IP address. This allows you to reject anyone coming from the darknet or deliberately disguising their origin.
• Cookie protection: Cookies are often used to track user sessions on a web application. WAAP solutions can prevent the modification of cookies and thus also session hijacking.
• Session protection: A hidden token prevents cross-site request forgery attacks in which the logged-in victim triggers unwanted actions without being aware of it.