SMB SSL-VPN: What is a Web Application Firewall? (FAQ)

03/26/2020 6 12266

DESCRIPTION:
SMB SSL-VPN: What is a Web Application Firewall? (FAQ)

RESOLUTION:

We value your feedback! While viewing an article, please click the "Rate" button and help us improve the knowledge base.

Frequently Asked Question:
 

1. What is a Web Application Firewall?

A Web Application Firewall acts as a single point of control to determine what should go in and out of the protected organization in the form of Web traffic. It is a special type of firewall that can inspect content exchanged over clear-text HTTP traffic, encrypted SSL traffic and traffic encoded using various encoding schemes.
 
With the advancement in Web 2.0 technologies, such as Ajax, a generic firewall is no longer sufficient in preventing attacks embedded inside dynamic Web content. A Web Application Firewall, on the other hand, is also capable of protecting applications written using Web 2.0 technologies.
 
An effective Web Application Firewall should protect against the OWASP Top Ten vulnerabilities (described below).

2. What is OWASP Top Ten?

OWASP Top Ten is the top 10 vulnerabilities listed by the OWASP working group. The protection for these vulnerabilities was listed as part of the PCI DSS 6.6 core requirements and has also been adopted by many industries as a compliance standard.

The Top Ten vulnerabilities include:

- Cross Site Scripting
- Injection Flaws, such as SQL injection and OS command injection.
- Malicious File Execution
- Insecure Direct Object Reference
- Cross Site Request Forgery
- Information Leakage and Improper Error Handling
- Broken Authentication and Session Management
- Insecure Cryptographic Storage
- Insecure Communications
- Failure to Restrict URL Access