Q44: Web Application Firewalls (WAF): Signature matching, anomaly detection, and Layer 7 DDoS mitigation. - Web Security & OWASP (50 Qs)

Architecture of a Modern WAF

A Web Application Firewall (WAF) sits at the network edge in front of your applications (e.g. AWS WAF, Cloudflare), inspecting incoming Layer 7 HTTP traffic to detect and block malicious payloads before they hit your compute servers.

scss

[ Incoming Traffic from Internet ]
                 |
                 v
+-------------------------------------------------------+
| Edge Web Application Firewall (WAF)                   |
|                                                       |
|   1. Managed Rule Groups (OWASP Top 10 Signatures)    | -> Blocks SQLi, XSS, Path Traversal
|   2. Rate Limiting Rules (e.g. > 2000 req/5m per IP)  | -> Throttles Layer 7 HTTP Floods
|   3. Geo-Blocking / IP Reputation Feeds               | -> Blocks known malicious Tor/Proxies
|   4. Bot Management & Challenge (Cloudflare Turnstile)| -> Validates non-headless browsers
+-------------------------------------------------------+
                 |
                 | (Allowed Clean Traffic)
                 v
   [ Application Load Balancer / EKS Pods ]

Managed Rules vs. Custom Rules

Managed Rule Sets: Pre-configured rules maintained by cloud providers (e.g., AWS Managed Rules for Core Rule Set, SQL database, POSIX operating systems) updated automatically when new 0-days emerge (like Log4Shell).
Custom Behavioral Rules: Rules tailored to your business logic (e.g., blocking any request containing specific staging debug headers or limiting requests to /api/auth/login to 5 per minute per IP).