WAF (Web Application Firewall)

What is WAF

WAF (Web Application Firewall) is a specialized solution for ensuring the security of web applications, API gateways and websites, operating at the application level (L7) of the OSI model. Unlike classic firewalls, which analyze IP addresses and ports, a WAF "looks" inside HTTP requests: methods, URI, headers and the request body, deciding whether to pass the traffic or block it.

In simple terms, if an ordinary firewall is a guard at the entrance to a building who checks your pass, then a WAF is an inspector who checks the contents of your bag to make sure you are not carrying weapons (malicious code). A WAF analyzes every request to your site or application and blocks suspicious ones.

A WAF is a mandatory element of protection for companies working with the digital ruble, FPS and state information systems, since web interfaces often become the main entry point for hackers. According to Positive Technologies, more than 70% of all attacks on web applications in Russia in 2025 were related to SQL injections and XSS vulnerabilities, which are effectively blocked by a WAF.

In the conditions of import substitution, Russian WAF solutions are included in the Register of Domestic Software and certified by FSTEC for protecting critical information infrastructure (CII) facilities.

How a WAF works

A WAF uses several methods to detect and block attacks, operating in real time (inline):

1. Signature analysis: Comparing incoming requests with a database of known attacks (for example, SQL injections, XSS, RCE). Databases are updated regularly (daily or weekly) and contain thousands of signatures for various types of attacks.
2. Behavioral analysis: Machine learning detects anomalies in traffic: uncharacteristic request patterns, activity spikes or suspicious sequences of actions. The system learns from typical traffic and detects deviations.
3. Compliance with standards: Blocking requests that violate protocol specifications (for example, HTTP Smuggling, incorrect headers, non-standard methods).
4. Bot protection: Behavior analysis (CAPTCHA, timing analysis, User-Agent verification) to filter out automated traffic and protect against bruteforce and DDoS attacks at the application level.

A WAF can operate in "learning mode", when the system only collects data about legitimate traffic and builds a profile of normal behavior, and in "blocking mode", when all suspicious requests are rejected. The choice of mode and fine tuning of rules is often performed within the automated systems design and development service.

Main types of WAF

WAF solutions are classified by the method of deployment, which affects performance, manageability and the level of security:

• Cloud (Cloud WAF / SaaS): Provided as a subscription service. They do not require equipment installation on the client side, are easily scaled and updated centrally. Suitable for small and medium-sized businesses and companies with distributed infrastructure. Examples: Cloudflare WAF, AWS WAF.
• Software (On-Premise): Installed on the company's own servers in its infrastructure. They provide full control over data and configuration, which is critical for CII facilities and government systems. Examples: PT Application Firewall (Positive Technologies), ModSecurity.
• Hardware: Physical devices installed in data centers in front of web servers. They provide maximum performance and low latency, and are suitable for high-load systems. Usually used in large corporations and data centers.

When choosing a WAF, it is important to consider integration with the existing infrastructure: SIEM systems for collecting logs and data storage systems for archiving security events.

Why a WAF is needed and how it protects

A WAF protects web applications from the most common threats described in the OWASP Top 10:

• Injections (SQL, NoSQL, OS Command): Blocking attempts to inject malicious code into requests to a database or operating system. For example, blocking the request `' OR 1=1 --` in a URL parameter.
• Cross-Site Scripting (XSS): Preventing the injection of JavaScript code into site pages that can steal cookies or redirect the user to a phishing site.
• Cross-Site Request Forgery (CSRF): Protection from attacks that force a user to perform unwanted actions on a site where he is authorized (for example, transferring money).
• DDoS attacks at the application level (L7 DDoS): Filtering out bot traffic imitating legitimate requests (for example, mass GET requests to heavy pages).
• Bruteforce (password guessing): Blocking multiple failed login attempts, protection from automated password guessing.

The implementation of a WAF as part of a comprehensive security system is often accompanied by attestation testing and staff training on training courses.