Filtering at the edge.
WHAT A WEB APPLICATION FIREWALL DOES
Inspects requests and blocks those matching known attack patterns.
WHAT IT CATCHES
Common injection attempts Known exploit patterns Obvious automated abuse
WHAT IT DOES NOT PROVIDE
Security for a poorly written application.
WHY THAT MATTERS
It is a compensating control, not a substitute for correct code.
WHAT FALSE POSITIVES ARE
Legitimate requests blocked.
WHAT CAUSES THEM
Rules matching ordinary content that resembles an attack.
WHAT TO DO ABOUT THEM
Run in monitoring mode first, observe what would be blocked, then enable.
WHY
Enabling blocking immediately breaks legitimate use.
WHAT ELSE EDGE SECURITY PROVIDES
Rate limiting Bot detection Geographic restriction Challenge mechanisms
WHAT TO BE CAREFUL WITH
Challenges that exclude legitimate users Geographic blocking that excludes your own market Bot detection blocking search engines
WHAT TO MONITOR
What is being blocked, and whether it should be.
WHAT TO REVIEW
Rules, after application changes.
