Fastly
Fastly is a leading edge cloud platform designed to build, secure, and deliver fast, scalable digital experiences. It …
Fastly is a leading edge cloud platform designed to build, secure, and deliver fast, scalable digital experiences. It combines a modern CDN, robust security features like a Next-Gen WAF, and a powerful serverless compute environment. Fastly helps businesses improve performance, enhance security, and innovate closer to their users, with specific solutions for e-commerce, streaming, and AI-powered applications.
About Web Application Firewall
A Web Application Firewall (WAF) is a security tool that filters, monitors, and blocks malicious HTTP/S traffic to and from a web application. Unlike traditional network firewalls that operate at lower network layers, a WAF functions at the application layer (Layer 7) to protect against specific web-based attacks like SQL injection, cross-site scripting (XSS), and file inclusion. By inspecting the content of every web request and response, these tools provide a critical defense layer for websites, APIs, and online services. Many modern WAFs leverage AI and machine learning to identify and block new, zero-day threats by analyzing traffic patterns and detecting anomalies in real-time.
Core Features
- OWASP Top 10 Protection: Provides dedicated rules and filters to mitigate the most critical web application security risks, such as injection flaws and broken authentication.
- Bot Mitigation: Identifies and blocks malicious automated traffic, including scrapers, credential stuffing bots, and spam bots, while allowing legitimate bots like search engine crawlers.
- Application-Layer DDoS Mitigation: Absorbs and filters high-volume distributed denial-of-service (DDoS) attacks targeting the application layer (e.g., HTTP floods) to ensure service availability.
- API Security: Protects APIs by enforcing schema validation, rate limiting, and blocking requests that exploit common API vulnerabilities.
- Virtual Patching: Allows administrators to apply immediate protection against newly discovered vulnerabilities without modifying the application's source code.
Use Cases
WAFs are essential for any organization with a public-facing web presence. They are widely used by e-commerce platforms to protect customer data and payment transactions, SaaS companies to secure their applications and APIs, and financial institutions to comply with security regulations. Content management systems (CMS) like WordPress and Joomla also benefit greatly from WAF protection against common plugin and theme vulnerabilities.
How to Choose
When selecting a Web Application Firewall, consider the deployment model (cloud-based, on-premises, or hybrid) that best fits your infrastructure. Evaluate its ability to customize security rules and the false positive rate, as overly aggressive rules can block legitimate traffic. Also, assess its performance impact on application latency, its logging and reporting capabilities for security analysis, and its integration with other security tools like SIEM systems.
Web Application FirewallUse Cases
Protecting E-commerce Sites from Payment Fraud
An e-commerce platform manager uses a WAF to secure their checkout process. The WAF inspects all incoming traffic to the payment gateway, identifying and blocking malicious bots attempting credential stuffing or carding attacks. It applies virtual patching to protect against known vulnerabilities in the shopping cart software and uses rate limiting to prevent brute-force attacks on login pages. This ensures customer payment data is safe, maintains PCI DSS compliance, and prevents fraudulent transactions that could lead to significant financial loss.
Securing APIs for Mobile and Web Applications
A development team for a SaaS product deploys a WAF to protect their backend APIs, which are consumed by both a mobile app and a web dashboard. The WAF enforces a strict API schema, automatically blocking any requests that don't conform to the expected structure, such as those attempting parameter tampering. It also protects against common API attacks like broken object-level authorization and mass assignment, ensuring that one user cannot access or modify another user's data. This provides a critical security layer without requiring extensive changes to the application code.
Mitigating Application-Layer DDoS Attacks
A popular online news portal faces frequent application-layer DDoS attacks, such as HTTP floods, that overwhelm its web servers and cause service outages. Their IT team implements a cloud-based WAF. The WAF's global network absorbs the massive volume of malicious traffic before it reaches the portal's infrastructure. It uses advanced rate-limiting and traffic analysis to distinguish between legitimate reader traffic and the attack, ensuring the site remains available to the public even during a large-scale attack. This proactive defense maintains uptime and protects the portal's reputation.
Preventing Account Takeover (ATO) Attacks
A financial services company uses a WAF with advanced bot detection to prevent account takeover attacks on its customer portal. The WAF analyzes user behavior, device fingerprints, and IP reputation to identify suspicious login attempts characteristic of credential stuffing. When a potential ATO attack is detected, the WAF can automatically block the offending IP address or present a CAPTCHA challenge to verify the user is human. This protects customer accounts from unauthorized access and fraud, building trust and reducing liability for the company.
Applying Virtual Patches for Zero-Day Vulnerabilities
A security team learns of a critical zero-day vulnerability in the open-source CMS powering their corporate website. While waiting for the official patch from the CMS vendor, which could take days, they use their WAF to apply a virtual patch. The security administrator creates a custom rule in the WAF that specifically blocks traffic patterns attempting to exploit this new vulnerability. This provides immediate, targeted protection, effectively closing the security hole and buying the development team crucial time to test and deploy the official software update without exposing the site to attack.
Blocking Malicious Bots and Content Scrapers
An online publisher invests heavily in creating unique content but finds that competitors are using automated scrapers to steal and republish it. They configure their WAF's bot management features to block these scrapers. The WAF uses techniques like JavaScript challenges, device fingerprinting, and behavioral analysis to distinguish human visitors from automated bots. It blocks known malicious user agents and IP addresses from bot networks, while ensuring legitimate crawlers from search engines can still access and index the site. This protects their intellectual property and maintains their SEO rankings.