You, Harrigan.
And welcome back to the lab course.
So in today's lecture, we'll be discussing more about the Web application firewall.
So Web Application Firewall is currently like one of the very critical components as far as the security
infrastructure is concerned.
And in most of the organizations, specifically the enterprise grade, you have Web application firewall
already implemented.
So let's look into what Web application Firewall is all about.
Now we all know what Firewall is, and most of us have already used firewall in some way or other.
It may be security groups, it may be IP tables.
So this is one of the things that you should already know.
Now, one important thing is that firewall, they generally operate on layer layer three and layer four
of the OSI model.
So we'll look into this.
So when you talk about the main aim of firewall, so the main aim of firewall is to block the malicious
or unauthorized traffic.
And I'm sure that you already know, so when you speak about that firewall works on layer three and
layer four, that means network and transport layer.
So generally if I open up a random packet, you have within the transport layer, you have various things
like source port, destination port.
If you go into the Internet protocol layer, you have the source IP destination IP.
You also have various things like sequence number, which is within the transport layer, and this is
where the stateful and stateless firewalls really play a vital role.
So this is something that we already know we allow based on IP addresses, port number.
So this is what the generic firewall does.
So coming back to the presentation, the main aim of firewall is basically to not allow the traffic,
which is malicious.
Now the question is when we look into the diagram, since the firewall operates at layer two or layer
four, it cannot really look into the layer seven traffic, which is the application traffic.
And this is where the question comes is that what about the malicious traffic like SQL injection attacks,
the cross site scripting attacks, which generally operates at the layer seven, specifically where
the HTTP protocol operates.
So if you look into the diagram, the non HTTP attacks can be already deferred with the standard packet
firewall.
So however the HTTP attack.
So since the firewall cannot really read the HTTP packets, let me show you again.
So within this packet you have the IP layer, you have the transport layer and you have the act layer.
So this is the layer seven.
So within layer seven you have a lot of information like user agent, you have the request, URI, you
have the host headers and a lot of and you have the ACT request itself.
So this is the URI portion.
So all of these things, the firewall cannot read because it does not operate on the layer seven.
And this is the reason why there is a need of a firewall, because layer seven where the applications
are running, they have a lot of attacks, a huge amount of attacks.
And this is the reason why there was a necessity to have a firewall which can read the HTTP packets,
which operates at layer seven and can protect applications against various kind of attacks.
So I'll show you there is a OWASP top ten, which has a lot of attacks specifically related to web applications.
It can be a SQL injection.
I'm sure you might have heard about it.
SQL injection.
You have cross-site scripting.
A lot of them are there.
These are detailed which are mentioned within the US top ten, and since all of them they generally
operate at layer Layer seven, you need a firewall which can protect you against the layer seven attacks.
And this is where the web application firewall is all about.
So Web application firewall are generally designed for web application and these kind of firewall,
they operate at layer seven.
So again, the rules that you write for web application firewall, these are rules specific for the
HTTP based communication.
So we'll look into it in detail, but just understand that one of the primary mottos of various kind
of apps which are available is to protect against the OWASP Top ten Matrix.
And this is very important, so considering the web app.
Viable firewall vendors.
There are a lot of vendors which are available.
It ranges from open source like Mod Security to various commercial solutions which are like signal signs.
Akamai you have VAF, which is also pretty interesting solutions.
As far as the commercials are concerned.
So even a lot of content delivery networks like Cloudflare, they offer the web application firewall,
which you can go ahead and look into it.
And definitely one of the best ones to have a high level overview is the abuse, because it is quite
straightforward and you can go ahead and create your own rule sets, create your own web based URLs,
etc..
So again, there are commercial ones like Akamai Signal Sciences, which are good.
But the problem with them is that many times they do not really entertain startups or startups which
have like five or six servers.
So that is quite a big pain.
And this is the reason why I generally recommend to go ahead and straightforwardly go with a very simple,
straightforward solution.
You can use it any time and you can implement anytime and it's a pay as you go.
So anyways, we'll discuss more about this in the relevant section, but I hope you understood the basics
about what web application firewall is all about.
Now, this lecture was only to have an overview on what web application firewall is, so in the relevant
sections we'll go a little bit deep and look into the implementation scenarios related to VAF.
So I hope this has been informative for you and I look forward to see you in the next lecture.