WAAS (Web-Application and API Security) can secure both containerized and non-containerized web applications. To deploy WAAS, create a new rule, and declare the entity to protect.
Although the deployment method varies slightly depending on the type of entity you’re protecting, the steps, in general, are:
- Define rule resource.
- Define application scope.
- Enable relevant protections.
Understanding WAAS rule resources and application scope
The WAAS rule engine is designed to let you tailor the best-suited protection for each part of your deployment. Each rule has two scopes:
- Rule resources.
- Application list.
This scope defines, for each type of deployment, a combination of one or more elements to which WAAS should attach itself in order to protect the web application:
In the event of scope overlap (when multiple rules are applied to the same resource scope), the first rule by order will apply and all others will not apply. You can reorder rules via the Order column in WAAS rule tables by dragging and dropping rules.
This scope defines the protected application’s endpoints within the deployment as a combination of one or more of the following:
To better illustrate, consider the following deployment scenario for a web application running on-top of an NGINX cluster:
In this example, different policies apply for different parts of the application. The steps for deploying a WAAS rule to protect the above described web application would be as follows:
- Define rule resources- Specify the resource collection the rule applies to. Collections are comprised of image names and one or more elements to which WAAS should attach itself in order to protect the web application. In the following example, the rule will apply to all containers created by the nginx image.
- Define protection policy for 'login', 'search' and 'product' endpoints- Set OWASP Top 10 protection to "Prevent" and geo-based access control to "Alert".
- Define protection policy for the application’s API endpoints- Set OWASP Top 10 and API protection to "Prevent" and HTTP header-based access control to "Alert".
Once the policy is defined, the rule overview shows the following rule resource and application definitions:
Protection evaluation flow
WAAS offers a range of protection targeted at different attack vectors. Requests inspected by WAAS will be inspected in the following order of protections:
- Bot protection
- App firewall (OWASP Top-10)
- API protection
- DoS protection
WAAS will continue to inspect a request until "Prevent" or "Ban" actions are triggered, at which point the request will be blocked, and the evaluation flow will be halted.
For instance, assume all protections in bot protection are set to "Prevent". An incoming request originating from a bot and containing a SQL injection payload would be blocked by the bot protection (since it precedes the app firewall in the evaluation flow), and the SQL injection payload will not be assessed by the app firewall.
In a different scenario, suppose that all bot protections are set to "Alert" and all app firewall protections are set to "Prevent". A request originating from a bot containing a command injection payload will generate an alert event by bot protection and will be blocked by the app firewall protection.
Deploying WAAS for Containers
To deploy WAAS for containerized web applications, create a new rule, specify the image name, define application endpoints and select protections. WAAS only needs to be applied to images that receive HTTP/HTTPS traffic.
- Open Console, and go toDefend > WAAS.
- Select theContainertab.
- ClickAdd Rule.
- Enter aRule NameandNotes(Optional) for describing the rule.
- Choose the ruleScopeby specifying the resource collection(s) to which it applies.Collections define a combination of image names and one or more elements to which WAAS should attach itself in order to protect the web application:
- ClickAdd New App.
- In theApp Definitiontab, specify the endpoints in your web application that should be protected. Each defined application can have multiple protected endpoints. If you have a Swagger or OpenAPI file, clickImport, and select the file to load. Otherwise, skip to the next step to manually define your application’s endpoints.
- If you do not have a Swagger or OpenAPI file, manually define each endpoint by specifying the host, port, and path.
- In theGeneral App Setuptab, clickAdd Endpoint.
- Specify endpoint details:
- EnterPort (required)Specify the TCP port listening for inbound HTTP traffic.
- EnterHTTP host(optional, wildcards supported).HTTP host names are specified in the form of [hostname]:[external port].External port is defined as the TCP port on the host, listening for inbound HTTP traffic. If the the value of the external port is "80" for non-TLS endpoints or "443" for TLS endpoints it can be omitted. Examples: "*.example.site", "docs.example.site", "www.example.site:8080", etc.
- EnterBase path(optional, wildcards supported):Base path for WAAS to match on, when applying protections.Examples: "/admin", "/" (root path only), "/*", /v2/api", etc.
- If your application uses TLS, setTLStoOn.WAAS must be able to decrypt and inspect HTTPS traffic to function properly.To facilitate inspection, after creating all endpoints, clickView TLS settingsin the endpoint setup menu.TLS settings:
- Minumun TLS version- A minimum version of TLS can be enforced by WAAS to prevent downgrading attacks (default value is TLS 1.2).
- HSTS- The HTTP Strict-Transport-Security (HSTS) response header lets web servers tell browsers to use HTTPS only, not HTTP. When enabled, WAAS would add the HSTS response header to all HTTPS server responses (if it is not already present) with the preconfigured directives - max-age, includeSubDomains and preload.
- If your application uses HTTP/2, setHTTP/2toOn.
- ClickCreate Endpoint
- Continue toAccess Controltab and select access controls to enable.
- Continue toDoS protectiontab and configure DoS protection thresholds.
- Continue toBot protectiontab and select bot protections to enable.
- You should be redirected to theRule Overviewpage.Select the created new rule to displayRule Resourcesand for each application a list ofprotected endpointsandenabled protections.
- Test protected endpoint using the following sanity tests.
- Go toMonitor > Events, click onWAAS for containersand observe events generated.
Deploying WAAS for hosts
To deploy WAAS to protect a host running a non-containerized web application, create a new rule, specify the host(s) where the application runs, define protected HTTP endpoints and select protections.
- Open Console, and go toDefend > WAAS.
- Select theHosttab
- ClickAdd Rule.
- Enter aRule Name