Security Practices | Check Point WAF

A practice refers to a recommended method for configuring and managing systems to achieve optimal security. It may include setting security policies, monitoring traffic, or deploying features like API Discovery. These practices help users effectively utilize WAF to protect web applications and APIs, ensuring compliance with cybersecurity best practices.

CloudGuard WAF provides two Security Best Practices that can be easily activated in Detect/Learn mode or Prevent Mode: Web Application Protection and Web API Protection.

The practices use multiple security engines to analyze HTTP web requests and to deliver accurate verdict whether the request is malicious or benign. The engines protect applications and APIs against unknown and advanced web attacks, validate the input of APIs, distinguish humans from bots and protects against industry's well known attacks and CVEs.

CloudGuard WAF Security Practices

• Web Application Protection Practice

  • Contextual Machine Learning based-WAF
  • Anti-Bot Protection
  • Intrusion Prevention
  • File Security
  • Custom Signatures (SNORT)

• Web API Protection Practice

  • Machine Learning based-WAF looks for malicious payload inside API requests
  • Schema Validation module ensure that API requests adhere to API schema
  • Intrusion Prevention
  • File Security
  • Custom Signatures (SNORT)

Security Engines

Contextual Machine Learning-based WAF : Prevent OWASP Top 10 and Advanced Attacks

This patented engine protects against advanced and zero-day web attacks. It executes a three-stage HTTP web request analysis and delivers an accurate verdict. It uses Contextual Machine Learning to identify if a web request is malicious or benign and provides:

1. Superior false-positive rate than traditional WAF.
2. Provide zero-day protection by blocking different attack scenarios that are not blocked with a signature-only approach such as Log4Shell and Spring4Shell.
3. Reduction in administration time as it is not constantly necessary to tune the engine, create exceptions, disable signatures, and more.

Learn more about the Contextual Machine Learning engines in the next section of this documentation.

API Security: Validate Schema and Prevent Attacks

Frequently, software developers do not include verification of API input in their code.

The CloudGuard WAF API security component provides two protection models: positive and negative. Administrators can enable one of them, or the two of them.

• The positive model delivers preemptive protection by validating API requests against uploaded schemas to block all invalid API requests.

CloudGuard WAF supports OpenAPI Schemas V3 and above.

• The negative model uses the WAF to automatically detect and block malicious payloads in the API.

DDoS Protection (CloudGuard WAF SaaS)

CloudGuard WAF SaaS delivers built-in, always-on Distributed Denial of Service (DDoS) protection. It natively defends against high-volume and stealthy attacks across network and application layers.

Anti-Bot Protection: Distinguish Humans from Bots

CloudGuard WAF Anti-Bot protection performs a three-step procedure:

1. Inject scripts into web application pages.
2. Collect data about input patterns to identify human vs. bot input.
3. Make a decision on whether the input is human or from an automatic script and block activity accordingly.

Intrusion Prevention (IPS)

In addition to Contextual Machine Learning, CloudGuard WAF provides traditional signature-based protections for over 2800 web-based CVEs. These signatures arrive automatically, allowing administrators to see logs that indicate specific CVE numbers.

File Security

Files uploaded may contain malicious content, and CloudGuard WAF's File security has several engines to detect such files.

Custom Signatures (Snort Engine)

Admins can add signatures in Snort format for enforcement by CloudGuard WAF Security Engines.