Application Security Terminology

Glossary

Web Application Firewalling (WAF)

A Web Application Firewall (WAF) is an application firewallfor HTTP applications. It applies a set of rules to an HTTP conversation that cover common attacks such as cross-site scripting (XSS) and SQL injection.

While proxies generally protect clients, web application firewalls protect servers. A WAF is deployed to protect a specific web application or set of web applications. As such, a web application firewall can be considered a reverse proxy.

WAFs may come in the form of an appliance, server plugin, or filter, and may be customized to an application. The effort to perform this customization can be significant and needs to be maintained as the application is modified.

While IDS/IPS systems are designed to provide a higher layer of security over a basic firewall, they do not typically understand or protect against application layer attacks such as SQL Injection, XSS, etc. This reason is why the PCI standard requires a WAF to protect Internet-facing web servers instead of just a firewall with IDS/IPS capabilities.

 For an example of a Web Application Firewall, read WhiteHat Security Sentinel Dynamic.