AWS WAF – A Cost-effective Web Application Firewall for Your SaaS Application

Web Application Firewall

A web application firewall is a system that intercepts all the traffic to your web application and filters out bad HTTP traffic, thereby protecting the web application from hackers and other bad actors.

As most of the businesses are moving online, hacking web applications has become a growing black market industry. You must have heard about several data breaches that have happened in the recent past. There is a separate section on data breaches in the new General Data Protection Regulation (GDPR) that the European Union (EU) has made enforceable from 25th May 2018. In such circumstances, it has become critical to protect your web applications as much as possible.

In traditional security model, web applications are protected using network firewalls and intrusion detection systems. However, these traditional solutions don’t protect web applications from security vulnerabilities such as SQL Injection, Cross Site Scripting (XSS) and others as mentioned in OWASP Top 10 security vulnerabilities.

A Web Application Firewall inspects each incoming HTTP request. It looks for common attack patterns and filters out the bad HTTP requests. This way only safe HTTP traffic reaches to your web application. This reduces the chances of a data breach by a great margin. This also helps you in compliances like HIPAA and PCI DSS.

AWS WAF

Even though web application firewalls were available for past few years, they typically cost thousands of US dollars in upfront as well as recurring costs. Also, installing and managing a web application firewall is a complicated affair. You need experienced system admins to ensure the correctness of the configuration and continuous availability of the web application firewall on your custom provisioned hardware.

This is where AWS WAF comes into the picture. AWS WAF is a managed service and its pricing is based on usage. You can protect your application with AWS WAF, starting from $25-$30 per month, and this includes millions of HTTP Requests. Since AWS WAF is hosted and managed by AWS, you don’t have to spend any of your resources on that front.

How to use AWS WAF?

AWS WAF is deeply integrated with various AWS services, such as Application Load Balancer (ALB) and CloudFront. When you deploy AWS WAF on your CloudFront or ALB deployment, it allows you to define certain security rules. You can define security rules to block SQL Injection, XSS attacks, Bad Bots, Content Scraping, etc.

AWS WAF also supports rate limit based rules which can protect your application from DDos and Brute Force Login Attacks.

In addition to this, AWS has a marketplace for security sellers. These sellers offer Managed WAF rules on the subscription basis. These rules are kept updated by those security sellers thus offering evolving protection against various types of attacks.

In addition to the above, here are some features that are offered by AWS WAF:

• Real-time monitoring of events using AWS Cloudwatch Logs
• Define custom error pages
• Inspect HTTP as well as HTTPS traffic

AWS WAF and HIPAA Compliance

AWS WAF is covered under AWS HIPAA compliance program. This means that if you have a HIPAA BAA with Amazon then you can use AWS WAF to protect your web-based system which handles PHI (Protected Health Information). In fact, if you are planning to deploy a healthcare system on AWS, using AWS WAF is highly recommended.

To Conclude,

AWS WAF offers a managed web application firewall which you can quickly deploy to protect your web applications hosted on AWS. If you have any queries or need any help in configuring AWS WAF, then you can contact us. Our AWS certified system administrators will reach out to you with an appropriate solution to your problems.

Author's Bio:

Pritam Barhate