July 3, 2019 By Sue Poremba 3 min read

Most of us rely on web applications for, well, just about everything, which is why a distributed denial-of-service (DDoS) attack or other Domain Name System (DNS)-related outage can have such a negative impact on a business. Because so much is centered on web services and similar technology nowadays, web application security must be a high priority within any security system.

Essential to web security are web application firewalls (WAFs), which protect web applications by analyzing HTTP/HTTPS data — as opposed to a regular firewall, which is designed to block transmissions based on other factors, such as IP addresses. However, a recent study conducted by Ponemon Institute and sponsored by Cequence Security found that a majority of users are dissatisfied with the effectiveness of these firewalls, and that opens the organization to greater security risks.

Dissatisfaction With Current Web Application Firewalls

A WAF is considered a critical tool because it adds web application security in ways that traditional firewalls and other security tools cannot. Web applications open the network to a wider range of vulnerabilities than other applications — such as SQL injections and cross-scripting — and they are designed to discern legitimate HTTP traffic before it reaches the application.

Yet according to the Ponemon study, only 40 percent of respondents said they are very satisfied with their WAF. This could be because they aren’t using the WAF to its full potential, as 43 percent admitted they only use it to generate alerts, rather than to actually block malicious activity. Sixty-five percent of respondents said a web application attack bypassed their WAF within the past year.

One possible reason behind this dissatisfaction with WAFs is that they are complex and managing them is time-consuming, essentially requiring someone to monitor them on a full-time basis. WAFs are costly as well, adding hundreds of thousands of dollars to the security budget.

In addition to the expense and management complexities, WAFs also have limitations that can add to that lack of satisfaction among users. For example, while they are effective at monitoring for HTTP-specific attacks, they are unable to protect from zero-day attacks or the rise of automated botnets. This is because WAFs are set up to detect preconfigured patterns, which a zero-day exploit bypasses. They also don’t fix vulnerabilities within the application. Hence, for the price and the time commitment, their function in the security system, while critical, doesn’t do enough.

Improve Web Application Security With AI and Consolidated Functions

So, as important as having a WAF is, you need other security tools in place to support and complement the firewall. The solution may be found in artificial intelligence (AI)-powered automation and a consolidation of application security functions.

“[Our customers] rely on web, mobile, and API-based applications to link customers, partners, and suppliers across their digital ecosystem,” said Franklyn Jones, CMO of Cequence Security, in a formal statement. “And they need an intelligent, integrated application security solution that can protect them against a broad range of sophisticated attacks.”

Integrating WAFs with other critical security tools can simplify your IT architecture and improve latency. One problem with legacy WAFs is that they are difficult to scale as needs change. Integration and consolidation of application security functions should address some of these issues without requiring larger, more expensive appliances.

With AI-powered solutions, organizations can put custom algorithms in place to better detect the threats not currently addressed by legacy WAFs. This is especially critical with the rise of internet of things (IoT)-based DDoS attacks, as AI-based WAFs can help detect the multipurpose botnets responsible for these attacks.

Automated web application security scanners can run scans across apps and websites to look for possible vulnerabilities. Like with penetration tests, there are black box — a blind scan — and white box — where the scan has access to the source code — approaches. White box scanning requires skilled staff, specifically someone familiar with the code. Black box scanning can typically be controlled by anyone on the IT or security team.

Web applications are a necessary part of doing business, meaning web application security has to be a top priority. A single exploit that sets up a DDoS attack or lets malware into your network could take you offline, make you more vulnerable to data breaches and hurt your company’s reputation. A web application firewall is a crucial but untrusted and underutilized security tool. If this tool is going to meet critical needs, organizations need to introduce new automated and consolidated technologies into the web app security system.

More from Data Protection

Data security tools make data loss prevention more efficient

3 min read - As businesses navigate the complexities of modern-day cybersecurity initiatives, data loss prevention (DLP) software is the frontline defense against potential data breaches and exfiltration. DLP solutions allow organizations to detect, react to and prevent data leakage or misuse of sensitive information that can lead to catastrophic consequences. However, while DLP solutions play a critical role in cybersecurity, their effectiveness significantly improves when integrated with the right tools and infrastructure. Key limitations of DLP solutions (and how to overcome them) DLP…

Defense in depth: Layering your security coverage

2 min read - The more valuable a possession, the more steps you take to protect it. A home, for example, is protected by the lock systems on doors and windows, but the valuable or sensitive items that a criminal might steal are stored with even more security — in a locked filing cabinet or a safe. This provides layers of protection for the things you really don’t want a thief to get their hands on. You tailor each item’s protection accordingly, depending on…

What is data security posture management?

3 min read - Do you know where all your organization’s data resides across your hybrid cloud environment? Is it appropriately protected? How sure are you? 30%? 50%? It may not be enough. The Cost of a Data Breach Report 2023 revealed that 82% of breaches involved data in the cloud, and 39% of breached data was stored across multiple types of environments. If you have any doubt, your enterprise should consider acquiring a data security posture management (DSPM) solution. With the global average…

Cost of a data breach: The evolving role of law enforcement

4 min read - If someone broke into your company’s office to steal your valuable assets, your first step would be to contact law enforcement. But would your reaction be the same if someone broke into your company’s network and accessed your most valuable assets through a data breach? A decade ago, when smartphones were still relatively new and most people were still coming to understand the value of data both corporate-wide and personally, there was little incentive to report cyber crime. It was…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today