7 Myths About Web Application Firewalls

Web Application Firewalls (WAF) have become essential to defend businesses, of all sizes, from sophisticated application layer attacks. Why is WAF so important? Because of the many points of integration within the internal and external system, web application is often seen as a gateway to mission critical information. When web application defence is weak, it makes it easy for an attacker to compromise the web application, gaining access to personal information and intellectual property. Protection against Distributed Denial of Service (DDoS) attacks (which is frequently covered by the mainstream media), is one of the key functionalities of the web application firewalls.
According to the Imperva’s Bot Traffic Report, nearly half of all website visitors are bots. 29% are bad bots including impersonators, hackers, thieves and spammers. An alarming 90% of security events are cause by bad bots, making web application defence even more essential for businesses.
​

1. We don’t need it because we already have perimeter firewalls - while perimeter firewalls are an important component of your defence against intruders, for the most part, perimeter firewalls are designed to protect the infrastructure layer, i.e. to make sure that your personal computers, file servers, and other network devices are not exposed and could not be easily accesses by cyber criminals. Web Application Firewalls are designed specifically to protect website and web applications without negatively affecting user experience.
2. It will slow down our website or web application - while it might be the case for some providers, leading WAF providers, utilize what’s called a Content Delivery Network (CDN), that generally makes your web applications run faster by temporarily caching some of the web application resources.
3. After it’s setup, I’m “chained” to the provider and can’t turn it off - because you are always in control of your own Domain Name Services (DNS) records and can also bypass it by simply disabling the WAF in settings, you will always remain in control and can make any changes if and when you need it.
4. Attackers can still succeed attacking the origin IP directly - this is only true when you don’t restrict access to the WAF provider’s IP ranges, or in simple terms, allow access to the web application directly bypassing the firewall. With the proper implementation, access to the web application must always flow through the WAF provider without exceptions. Your webmaster will know how to make this simple change.
5. It will take a lot of time and resources to implement WAF - implementing an on-premise solution can be cumbersome. However, when you use a SaaS solution, most web application firewall deployments take anywhere between one and three business days unless you have tens or hundreds of web applications, in which case it may take a bit longer.
6. It’s too expensive to implement and manage WAF - contrary to the popular belief, it’s truly affordable for virtually any size business. Moreover, fully-managed WAF solutions will save you money since the idea behind it is to reduce the overall pressure on your IT support personnel, whether in-house or external. It will also protect your business against both reputational damage and legal liability due to potential loss of customer data.
7. It keeps the application data in cache making us non-compliant - in many cases, and in order to speed up the process of safeguarding your data by blocking bad bots and DDoS attacks, the data in-flight is processed in memory and is not kept as physical media for prolonged periods of time. Generally, you will have full control over the caching methods and settings and will be able to ensure that no copies of data are stored elsewhere.​

---