Video: Understand the difference between network firewalls and web application firewalls (WAFs). Together, these two developments - the WAF and the OWASP Top 10 - have given us a defense to help stop threat actors attempting to compromise our systems, consume our resources and exfiltrate our data.

Decades later, the OWASP Top 10 remains the industry standard for web application security compliance.

Parallel with emergence of WAF technology, the OASIS Web Application Security Technical Committee’s (WAS TC) vulnerability work was expanded into the Open Web Application Security Project’s (OWASP) Top 10 List. The WAF has since evolved to sit between the application and the client - a position referred to as “inline” - where it filters HTTP traffic to and from the web service to block the malicious request.

Early versions of web application firewalls protected applications from the submission of illegal characters. Many applications can't be isolated on internal networks because they need to connect to the internet.Įfforts to safeguard against the rise in attacks on web applications led to the development of WAF technology in the late 1990s. But the traditional firewall approach isn’t ideal for the cloud. In the pre-cloud era, you could use firewalls to segment internal from external networks to protect your assets from malicious network traffic. Their ability to detect and respond to malicious requests before web applications and web servers accept the requests provides businesses (and their customers) with essential security. A web application firewall (WAF) is a type of firewall that protects web applications and APIs by filtering, monitoring and blocking malicious web traffic and application-layer attacks - such as DDoS, SQL injection, cookie manipulation, cross-site scripting (XSS), cross-site forgery and file inclusion.Īs a Layer 7 defense, WAFs focus on traffic between web applications and the internet.

Ngfw networking