Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

For Network Layer Firewalls we have different sort of redundancy and consistency checks like rule shadowing, that can impact the performance of firewall. Do similar kind of checks can be applied on WAFs, i have some questions ?

  1. Does order of Rules matter ?
  2. How inconsistent rules are handle.
  3. How redundancy is removed from the ruleset
  4. Can rules be bypassed for static application layer signatures
share|improve this question
    
Order can be optimized, just like everything else, in this case, manually. These signatures are not static, I think there is decode working there as well, so it's not that simple to encode the code to bypass WAF. –  Andrew Smith Aug 6 '12 at 20:16

2 Answers 2

up vote 3 down vote accepted

I work for a security company (Incapsula) and one of our product features is a PCI DDS compliant WAF. I think @symcbean already gave a great answer, so I`m just here to add a little info to the discussion:

Does order of Rules matter ?

@symcbean said it all.

How inconsistent rules are handle.

If you are referring to a scenario in which several (relevant) rules reach different conclusions, then my advise it to always go with the "harshest judgment".

This is up to you, of course. You can go the other way and implement a more lenient approach which will prevent more "false positives" but I think that, for most, security is a much bigger issue. Also, a good rule-set will eliminate most "false positives" and inconsistencies will be few and far between. For SAAS, you should have a lot of customization options to override default system rules, but the default setup still should be geared towards maximum security.

How redundancy is removed from the ruleset

As previously stated, there should be no redundancy in your rule-set.

Can rules be bypassed for static application layer signatures

Yes. For example, in Incapsula we use an application optimization rules which identifies commonly used applications and platforms and modifies behavior accordingly. (i.e. optimization for WP, Joomla, popular extensions and plugins and etc) I`m not advocating optimization for all possible scenarios here (simply ineffective) but if you are thinking about mass-marketing, you should at least cover the more common platforms/applications.

Best of luck

share|improve this answer

Does order of Rules matter ?

Of course. It's mostly about performance.

Even if your firewall only implements an accept/deny policy (it could, for instance, decide to route the request elsewhere) then the length of time it will take to decide what to do with it will depend on the number of rules it has to process in order to reach a decision and the effort required for resolving those questions. Hence ordering has a huge impact on performance.

Further, most such firewalls benefit from fuzzy rules - a single rule (or even a single web request in session) may not carry enough information to determine whether a request should be processed or not - the firewall therefore maintains a lot more state than a layer 5 stateful firewall.

How inconsistent rules are handle.

No idea what you mean by this.

How redundancy is removed from the ruleset

By design.

Can rules be bypassed for static application layer signatures

Yes, if you configure the rules to allow this.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.