Security control that protects web applications by filtering and monitoring HTTP traffic for attacks.
A Web Application Firewall (WAF) sits in front of web applications to protect against attacks that target application vulnerabilities—SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats. WAF inspects HTTP/HTTPS requests, blocking malicious patterns before they reach the application. WAFs can operate based on known attack signatures, anomaly detection, or both. They're deployed as hardware appliances, software, or cloud services (like Cloudflare or AWS WAF). WAF is essential for any publicly accessible web application, especially those handling sensitive data.
Why It Matters
The DSC Perspective:
Web applications are constantly probed for vulnerabilities. WAF provides an essential layer of protection, catching attacks before they exploit application flaws. Required by PCI DSS for e-commerce and increasingly expected for any business-critical web application.