Best web application firewalls

Still relatively new to the world of firewalls, Web Application Firewalls (WAFs) don’t simply use IP addresses or ports to allow or block traffic. Instead, they actually analyze the traffic itself and use this data to make decisions according to set rules.

As per their name, Web Application Firewalls are mainly designed to keep web-based applications safe. Many businesses are moving towards the use of firewall websites as part of their IT security strategy, but it can be a daunting task to choose from the range of firewall websites available.

Each service has its own pros and cons and will exist as a software package to buy or a cloud-deployed service to license. With this in mind, here are some of our favorite web application firewalls.

Understanding firewall websites and devices

Let’s quickly review what these tools offer. WAFs help to ramp up the security on a web-based application, offering better safety than a standard firewall.

Typically, it will offer protection against attacks such as cookie poisoning, cross-site scripting, parameter tampering, web scraping or buffer overflow. They do this by analyzing the HTML to seek out any malicious code or malware signatures.

Getting the best security results

Web application services work even more effectively when they are combined with an antivirus or standard firewall systems. Most users will look to implement a multi-layer approach to blocking malware, so this holistic approach can be a good one.

What type of WAF?

You can use an appliance or cloud-based WAF, delivered via firewall websites. With cloud-based firewall websites, the vendor does the hosting and uses a DNS to redirect website requests to your WAF and then website after verification.

The hardware WAFS are basically specialist computers which are installed into a data centre and which provide a protective layer between web servers and traditional firewalls.

Things to consider when choosing a WAF

Cloud-based firewall websites

• are handled by the vendor and need no maintenance.
• have high availability features
• handle system backups
• can be bundled with other services for an integrated security solution with one vendor

However, they may also lock you into a bundle of services with the one provider.

WAF appliances means that

• everything remains in-house
• you retain control across your full infrastructure
• you can use different vendors for each component part

However, you need to maintain and upgrade it yourself and the upfront costs of equipment investment are higher.

Which cloud-based firewall websites would we recommend?

In our opinion, these are five of the best cloud WAFs on the market right now. They are all on offer from good suppliers and offer great security with value for money. All are great solutions in their own right, so it’s worth weighing them up individually to see which will align most closely with your unique needs.

Cloudflare’s WAF

This service has a great reputation among the firewall websites on offer for providing thorough protection against server-based DDoS attacks. It includes a WAF and has a huge customer base, handling nearly 3 million requests every second. Just visit the website to see how many WAF rules have been applied within the past 24 hours; anything over 400 million is typical!

Choosing a WAF with plenty of existing customers means that you’ll use an intelligent learning system that uses insights gained from other client cases. For example, if it detects a malware attempt in one place, it will create the necessary block signature and then roll it out across its entire client base. Alongside DDoS protection, it also offers content delivery.

Akamai’s Kona Site Defender

This provider is a global leader when it comes to content delivery, and Akami keeps growing its offer with new functionalities and features. The Kona Site Defender is one key example, with fully integrated DDoS protection via the WAF.

You can combine the service with a range of others, including the Content Delivery Network. Akami’s client base and operating size mean that it tends to be among the first to identify attack attempts, meaning that you have an excellent chance of rapid and thorough protection in the event of an attack.

F5’s Silverline

F5 products are best known for their BIG-IP appliances. However, this cloud service WAF is basically the online version of its extremely solid BIG-IP ASM appliance. You can licence it under a managed service contract with F5 or choose an “express self-service” which protects data and web applications from threats. Choose a 1-3 year subscription which includes around the clock support from expert agents.

The service is ideal for offering protection for cloud-hosted and distributed infrastructure alike, with layer 7 DDoS shields and automatic blocking of anonymous addresses. It employs a real-time blacklist of web scrapers and phishing users and shares this across its client base.

Amazon Web Services WAF

AWS, or Amazon Web Services to be precise, is the cloud-based hosting offer from Amazon and known universally. By using the vast infrastructure of Amazon, it can offer cost-effective, high quality hosting with features such as a content delivery service and load-balancing.

Its pricing model differs from other vendors and you’ll be invoiced per security rule and web request numbers each month. This means you can scale up your service as needed over time. The model also works very well for businesses which experience seasonal capacity peaks.

Imperva’s Incapsula

Again, a big player in IT security, this is a managed service that prevents application-layer attacks including zero-day threats and all top ten Open Web Application Security Project attacks. It’s PCI-certified and also offers excellent customization. A really solid system, it will offer protection against the majority of threats with a minimum of false positives.

At the same time, it sends patches to any issues found on your web applications, as well as offering the standard WAF approach. You can also schedule patches according to your own needs and whenever you like to minimise threats to your infrastructure.

It’s also one of the most affordable firewall websites on the market.

In summary

There are plenty of web application firewalls available on the market and each vendor offers a range of features, along with a broader package of solutions that can protect your business or website.

This service market means that it can be difficult to pick the right solution initially, so it is well worth taking the time to identify your own specific needs first and then find the right offer that meets them.

Additionally, think about how much your needs are likely to grow, or whether you will have any seasonal usage variation to take into account. (The latter point will influence the pricing model that will suit you in particular.)

Planning ahead

Remember, once you have signed up to your WAF, it is far easier to stick with your vendor and its service package rather than have to make a switch later on. These firewall websites are an investment and your staff will need training to use them properly. Similarly, your IT team (or your service provider) will need to configure the solution to meet your needs.

Avoid having to do it twice by identifying your requirements and your project growth path and you’ll be best placed to choose the perfect WAF and safeguard your business to the highest degree.