Web Application Firewall - Revision history

Jtpereyda: Clearing up clutter

2016-10-18T23:33:30Z

Clearing up clutter

Jtpereyda: /* Description */ Adding clarifying info comparing with proxies and reverse proxies. Source: http://security.stackexchange.com/a/93847/5997

2016-10-18T23:16:00Z

‎Description: Adding clarifying info comparing with proxies and reverse proxies. Source: http://security.stackexchange.com/a/93847/5997

Jmanico at 08:27, 29 June 2016

2016-06-29T08:27:33Z

Jmanico at 08:26, 29 June 2016

2016-06-29T08:26:04Z

Jmanico: /* OWASP Projects */

2015-09-15T19:55:05Z

‎OWASP Projects

Jmanico: /* Choosing a Web Application Firewall */

2015-09-15T19:54:22Z

‎Choosing a Web Application Firewall

Jmanico: /* OWASP Projects */

2015-09-15T19:54:07Z

‎OWASP Projects

Jmanico: /* OWASP Projects */

2015-09-15T19:53:49Z

‎OWASP Projects

Jmanico: /* Tools */

2015-09-15T19:53:36Z

‎Tools

Jmanico: /* Choosing A WAF */

2015-09-15T19:53:14Z

‎Choosing A WAF

@@ Line 1: / Line 1: @@
 =Description=
-A '''web application firewall (WAF)''' is an appliance, server plugin, or filter that applies a set of rules to an HTTP conversation. Generally, these rules cover common attacks such as [[Cross-site Scripting (XSS)|cross-site scripting (XSS)]] and [[SQL Injection|SQL injection]].
+A '''web application firewall (WAF)''' is an [https://en.wikipedia.org/wiki/Application_firewall application firewall] for HTTP applications. It applies a set of rules to an HTTP conversation. Generally, these rules cover common attacks such as [[Cross-site Scripting (XSS)|cross-site scripting (XSS)]] and [[SQL Injection|SQL injection]].
-A WAF differs from a proxy in that proxies protect clients, while WAFs protect servers. A WAF is deployed to protect a specific web application or set of web applications. A WAF can be considered a [https://en.wikipedia.org/wiki/Reverse_proxy reverse proxy].
+While proxies generally protect clients, WAFs protect servers. A WAF is deployed to protect a specific web application or set of web applications. A WAF can be considered a [https://en.wikipedia.org/wiki/Reverse_proxy reverse proxy].
-WAFs may be customized to an application. The effort to perform this customization can be significant and needs to be maintained as the application is modified.
+WAFs may come in the form of an appliance, server plugin, or filter, and may be customized to an application. The effort to perform this customization can be significant and needs to be maintained as the application is modified.
 = OWASP Projects =
 * The [https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project OWASP ModSecurity CRS Project's] goal is to provide an easily "pluggable" set of generic attack detection rules that provide a base level of protection for any web application.
 * Consider the [https://www.owasp.org/index.php/WASC_OWASP_Web_Application_Firewall_Evaluation_Criteria_Project Web Application Firewall Evaluation Criteria Project (WAFEC)] to help evaluate commercial and open source web application firewalls.
 [[Category: OWASP WAF]]

@@ Line 1: / Line 1: @@
 =Description=
-A web application firewall (WAF) is an appliance, server plugin, or filter that applies a set of rules to an HTTP conversation. Generally, these rules cover common attacks such as [[Cross-site Scripting (XSS)|cross-site scripting (XSS)]] and [[SQL Injection|SQL injection]]. By customizing the rules to your application, many attacks can be identified and blocked. The effort to perform this customization can be significant and needs to be maintained as the application is modified.
+A WAF differs from a proxy in that proxies protect clients, while WAFs protect servers. A WAF is deployed to protect a specific web application or set of web applications. A WAF can be considered a [https://en.wikipedia.org/wiki/Reverse_proxy reverse proxy].
-A far more detailed description is available at [http://en.wikipedia.org/wiki/Application_firewall Wikipedia].
+WAFs may be customized to an application. The effort to perform this customization can be significant and needs to be maintained as the application is modified.
 = OWASP Projects =

@@ Line 1: / Line 1: @@
-{{Template:Countermeasure}}
+=Description=
 A web application firewall (WAF) is an appliance, server plugin, or filter that applies a set of rules to an HTTP conversation. Generally, these rules cover common attacks such as [[Cross-site Scripting (XSS)|cross-site scripting (XSS)]] and [[SQL Injection|SQL injection]]. By customizing the rules to your application, many attacks can be identified and blocked. The effort to perform this customization can be significant and needs to be maintained as the application is modified.
@@ Line 7: / Line 5: @@
 A far more detailed description is available at [http://en.wikipedia.org/wiki/Application_firewall Wikipedia].
-== OWASP Projects ==
+= OWASP Projects =
 * The [https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project OWASP ModSecurity CRS Project's] goal is to provide an easily "pluggable" set of generic attack detection rules that provide a base level of protection for any web application.
@@ Line 14: / Line 12: @@
 [[Category: OWASP WAF]]
-== References  ==
+= References  =
 *https://en.wikipedia.org/wiki/Application_firewall

@@ Line 12: / Line 12: @@
 * Consider the [https://www.owasp.org/index.php/WASC_OWASP_Web_Application_Firewall_Evaluation_Criteria_Project Web Application Firewall Evaluation Criteria Project (WAFEC)] to help evaluate commercial and open source web application firewalls.
 [[Category: OWASP WAF]]
 == References  ==
 *https://en.wikipedia.org/wiki/Application_firewall

@@ Line 9: / Line 9: @@
 == OWASP Projects ==
-* https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project
+* The [https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project OWASP ModSecurity CRS Project's] goal is to provide an easily "pluggable" set of generic attack detection rules that provide a base level of protection for any web application.
-* Consider the Web Application Firewall Evaluation Criteria Project (WAFEC) to help evaluate commercial and open source web application firewalls.
+* Consider the [https://www.owasp.org/index.php/WASC_OWASP_Web_Application_Firewall_Evaluation_Criteria_Project Web Application Firewall Evaluation Criteria Project (WAFEC)] to help evaluate commercial and open source web application firewalls.
 [[Category: Control]]

← Older revision		Revision as of 19:54, 15 September 2015
Line 10:		Line 10:

	* https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project		* https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project
		+	* Consider the Web Application Firewall Evaluation Criteria Project (WAFEC) to help evaluate commercial and open source web application firewalls.

	== Choosing a Web Application Firewall ==		== Choosing a Web Application Firewall ==

← Older revision		Revision as of 19:53, 15 September 2015
Line 10:		Line 10:

	* https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project		* https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project
−	* [https://www.owasp.org/index.php/OWASP_NAXSI_Project NAXSI] is a WAF for NGINX.

	== Choosing a Web Application Firewall ==		== Choosing a Web Application Firewall ==

@@ Line 14: / Line 14: @@
 * [https://www.owasp.org/index.php/OWASP_NAXSI_Project NAXSI] is a WAF for NGINX.
-== Choosing A WAF  ==
+== Choosing a Web Application Firewall  ==
 Consider the [https://www.owasp.org/index.php/WASC_OWASP_Web_Application_Firewall_Evaluation_Criteria_Project Web Application Firewall Evaluation Criteria Project (WAFEC)] to help evaluate commercial and open source web application firewalls.