A web application firewall (WAF) protects applications and APIs. WAFs are usually placed in front or before web-facing applications to detect and protect against a variety of malicious attacks. A WAF is focused on web application traffic (HTTP/S) and protects applications in internet-facing zones of the network.
WAFs are available as a service in the cloud or may be deployed as a hardware or virtual appliance in a hybrid topology. The hybrid deployment may span physical and software-defined data centers and private or public cloud-based environments.
A WAF can use many techniques to understand whether traffic should be allowed to pass through to an application or should be blocked, including behavioral algorithms (machine learning and a positive security model) and/or a negative security model.
最后，WAF正在从独立工具过渡到完全集成的Web应用和API保护（WAAP）产品，其中包括API防护、僵尸程序管理和风险缓解功能、第7层应用层DDoS防护、Web应用安全等一整套功能。
Learn more in our detailed guide to WAF security.
Next-Generation Firewalls (NGFW) protect against unauthorized access to a computer network. NGFW add additional capabilities to a traditional network firewall, including antivirus, anti-malware, intrusion prevention, URL filtering, and certain application security capabilities, to their network firewall functionality.
NGFW protect unauthorized access by creating and separating a secure zone from a less secure zone. They use configuration and access control policies to control communications between the two zones.
NGFW and WAFs protect against different types of threats and complement each other.
In the same way a WAF relies on an NGFW or a network firewall to protect against attacks at network Layer 3 and 4; an NGFW requires WAF/WAAPs to provide more comprehensive protection of applications, in addition to protecting published and unlisted APIs and offering bot management capabilities.
| |
WAF |
NGFW |
| 侧重领域 |
Web应用 - OSI层 |
Network protocols at Layer 3 and 4 of OSI model; some NGFW add basic application protection capabilities |
| 功能 |
保护面向互联网的区域中面向Web的应用 |
保护内部网络。将网络分隔为安全区域和不太安全的区域，并防止对安全区域进行未经授权的访问。 |
| 能力 |
针对XSS、CSRF、API安全、BOT保护、API发现的Web应用保护 |
保护DNS、FTP、SMTP、SSH和Telnet。NGFW增添了防病毒、反恶意软件和IPS功能以及一些应用安全性。 |
Related conten: Read our guide to WAF vs IPS.
其他资源