For Network Layer Firewalls we have different sort of redundancy and consistency checks like rule shadowing, that can impact the performance of firewall. Do similar kind of checks can be applied on WAFs, i have some questions ?
I work for a security company (Incapsula) and one of our product features is a PCI DDS compliant WAF. I think @symcbean already gave a great answer, so I`m just here to add a little info to the discussion:
Does order of Rules matter ?
@symcbean said it all.
How inconsistent rules are handle.
If you are referring to a scenario in which several (relevant) rules reach different conclusions, then my advise it to always go with the "harshest judgment".
This is up to you, of course. You can go the other way and implement a more lenient approach which will prevent more "false positives" but I think that, for most, security is a much bigger issue. Also, a good rule-set will eliminate most "false positives" and inconsistencies will be few and far between. For SAAS, you should have a lot of customization options to override default system rules, but the default setup still should be geared towards maximum security.
How redundancy is removed from the ruleset
As previously stated, there should be no redundancy in your rule-set.
Can rules be bypassed for static application layer signatures
Yes. For example, in Incapsula we use an application optimization rules which identifies commonly used applications and platforms and modifies behavior accordingly. (i.e. optimization for WP, Joomla, popular extensions and plugins and etc) I`m not advocating optimization for all possible scenarios here (simply ineffective) but if you are thinking about mass-marketing, you should at least cover the more common platforms/applications.
Best of luck
Does order of Rules matter ?
Of course. It's mostly about performance.
Even if your firewall only implements an accept/deny policy (it could, for instance, decide to route the request elsewhere) then the length of time it will take to decide what to do with it will depend on the number of rules it has to process in order to reach a decision and the effort required for resolving those questions. Hence ordering has a huge impact on performance.
Further, most such firewalls benefit from fuzzy rules - a single rule (or even a single web request in session) may not carry enough information to determine whether a request should be processed or not - the firewall therefore maintains a lot more state than a layer 5 stateful firewall.
How inconsistent rules are handle.
No idea what you mean by this.
How redundancy is removed from the ruleset
By design.
Can rules be bypassed for static application layer signatures
Yes, if you configure the rules to allow this.
