The role of Web application firewall

WAF, mainly to enhance the protection of web-specific intrusion methods, such as DDoS protection, SQL injection, XML injection, XSS, etc. Because it is an intrusion of the application layer rather than the network layer, it should be called Web IPS from a technical point of view, notWebApplicationFirewall . Because the focus is on anti- SQL injection, others are called SQL firewalls.

in computer networks, a network firewall acts as a barrier against potentially malicious activity and allows people to communicate between your secure network and an open, insecure network through a "door". Originally, a firewall is composed of a separate machine, placed between your private network and the public network. In recent years, the firewall mechanism has developed to not only "firlwall box", but more to the bastion host. It now involves the entire area from the internal network to the external network, consisting of a series of complex machines and programs. In short, the main concept of today's firewall is the application of multiple components.

Firewalls are critical in the implementation of network security. In most cases, the components of the firewall are used together to meet the requirements for corporate security purposes. The firewall should be able to ensure that the following four targets are met:

Implement a company's security policy

The primary intent of the firewall is to enforce your security policy. For example, perhaps your security policy simply restricts SMTP traffic to the mail server, so you have to enforce these policies directly at the firewall.

Create a blocking point

A firewall establishes a checkpoint between a corporate private network and a distribution network. This implementation requires all traffic to pass through this checkpoint. Once these checkpoints are clearly established, the firewall device can monitor, filter, and check all incoming and outgoing traffic. The network security industry says these checkpoints are blocking points. By forcing all incoming and outgoing traffic through these checkpoints, network administrators can focus on fewer places for security purposes. Without such a point for monitoring and controlling information, the system or security administrator would have to monitor it in a large number of places. Another name for the checkpoint is called the network boundary.

Record Internet activity

Firewalls can also enforce logging and provide alerting capabilities. By implementing log services on the firewall, security administrators can monitor all access from the extranet or the Internet. A good logging strategy is one of the most effective tools for achieving proper network security. Firewalls provide more information for administrators to log archives.

Restricting network exposure

The firewall creates a protected boundary around your network. And the public network hides some of your internal system information to increase confidentiality. When the remote node detects your network, they can only see the firewall. The remote device will not know the layout of your internal network and what it is. Firewalls improve authentication capabilities and network encryption to limit the exposure of network information. The source checks the incoming traffic to limit the attack from the outside.

The role of Web application firewall