What is Web Application and API Protection (WAAP)?
Web Application and API Protection (WAAP) describes a suite of security tools that discover and secure today’s complex applications. Large swathes of today’s web applications are built and run via Application Programming Interfaces (APIs) – lightweight software interfaces that allow applications to share data. This interactivity opens up new avenues of attack, however, and WAAP is purpose-built to close the holes that APIs have poked in traditional network security.
How Traditional WAF is limited
Before delving into WAAP capabilities, it’s worth contextualising the threat landscape they are built for. APIs are designed to share data quickly and easily. This makes them drastically different than the software that older network security platforms kept safe. Web Application Firewalls (WAFs) were built to protect web applications with largely static behaviours, and a user base that communicates in largely predefined ways. This is an ideal environment for rule-based security policies: WAFs simply checked each HTTP communication against their internal policies; anything resembling suspicious behaviour could be blocked before an attack reaches internal users.
To demonstrate why the WAF’s policy-based approach is limited, let’s assess some of the common risks facing API security:
Correct User Authentication
When interacting with web apps, users should only be able to access the resources that correspond to their role’s permission level. However, some APIs aren’t coded to perform a user authentication check – a vulnerability so common that OWASP issued it the name of Broken Object Level Authorization. APIs that don’t perform this action allow an attacker to call an API, place a false user ID in the user parameter, and gain access to that user’s or endpoint’s details.
Token Theft
Alternatively, APIs that do authenticate their users may be at risk of token theft. Every time the user or endpoint verifies their identity with the API’s auth server, they are issued a token that verifies their access to the underlying API. These tokens should be set to expire regularly – however, some developers choose to issue permanent tokens. If this token is stolen, for instance through a man-in-the-middle attack, an attacker can access the user’s account indefinitely.
WAF Rule Limitations
WAF rules are essentially incapable of spotting improper access within APIs. A WAF built to spot HTML patterns struggles immensely against the complex and nested structures used by APIs. Signatures are not the optimum format for reliably encoding business and authentication processes.
Even worse, attempting to implement WAF signatures in API contexts often yields a large number of false positives. This means that the WAF issues alerts on and may even block legitimate API usage.
WAAP: How It Works, and Core Components
This isn’t to declare WAF obsolete – at the core of WAAP is a Web Application Firewall. WAAP also follows the same architectural design, since it’s also positioned as a reverse proxy that sits between users and backend services.
Instead of relying solely on WAF capabilities, however, WAAP benefits from several further components on top of it. Note that Gartner defines WAAP as cloud-based, since it requires not only integration with an organization’s pre-existing network tools, but also a backbone of threat intelligence that is updated on an ongoing basis.
Web Application Firewall (WAF)
The WAF continues to serve as an efficient and highly scalable layer of defense. It inspects all HTTP/S traffic going to and from the application and its users – a foundational baseline for securing a web application. Advanced WAF modules are based on a continuously-updated ruleset, which allows for virtual patching as threats are newly discovered. Real-time threat feeds can incorporate a provider’s full breadth of vulnerability intelligence feeds, allowing for near real-time protection.
Alongside that, an advanced WAF can offer Deep Packet Inspection (DPI). Traditional WAFs would examine the packet headers of user requests – which show where the packet is travelling to and from, alongside how it’s routed there. DPI supersedes this by examining the full content of data packets and their payload as they pass through a network.
This deeper analysis allows a WAF engine to block not just individually dangerous packets, but also more complex attacks, such as a compromised application that begins requesting connections to command-and-control servers. Contextually-driven protocols can therefore consider the broader context of each request, such as user identity, location, time, device, and where the data appears within the request.
Finally, all of this real-time HTTPS traffic data is fed into a behavioral analytics platform. This allows the WAF to build a profile of how each application is called over time, and how different users behave.
API Gateway
API security is a core component of WAAP. Architectured as an API gateway, the WAAP acts as a single point of entry that ingests each request, before either routing them to the appropriate backend service, or invoking any requested backend services and aggregating its results.
From a security visibility perspective, this allows for far better API visibility. API discovery can be semi-automated, as the WAAP solution scans traffic and associated endpoints to detect the APIs currently in use. Once added to an inventory, a manual review is then performed – verified APIs are moved into a baseline inventory, whilst any unexpected discoveries are flagged as shadow APIs and listed for further verification.
Part of this process includes validating what schema each API adheres to. When each API is discovered, the WAAP tool ingests its sampled request and response data and matches it against an internal list of common schemas. Any uncommon schema can be verified manually. Alongside schema, this WAAP discovery includes each API’s authentication elements.
The learned or imported API schemas allow for validation to be applied to incoming and outgoing requests. This, therefore, ensures that even third-party APIs are adhering to best practices such as OAuth 2.0 authentication, input sanitization, and rate limiting. Modern WAAP platforms often integrate API gateways for real-time traffic visibility and automated API inventory management.
Bot Management
While APIs and individual users are important to secure, there is one other actor to consider when securing applications: bots. Thankfully, bots often behave in ways that differentiate them from genuine users and API calls – for instance, humans move their mouse pointers in random, organic ways, while bots either simulate mouse movements in mechanical straight lines, or not at all. WAAP collects client-side activity, alongside parameters like device, browser, and network.
WAAP best practices then denote that a suspected bot must be issued with a challenge, such as JavaScript or CAPTCHA. Once verified as a bot, it can then be blocked or issued with sensible rate limits.
Access Management
Earlier, we touched on the importance of secure API authentication. WAAP grants visibility and enforcement to this, by integrating with an organization’s pre-existing Identity and Access Management (IAM) provider.
Once integrated, the WAAP can capture and validate all access tokens issued in API authentication – and ensure that each API call carries a valid, unexpired credential. This provides a framework through which an organization can detect and remove stolen access tokens, while enforcing regular token renewal within its active APIs.
From an end-user’s perspective, WAAP tools can make the authentication process faster, since they support federated identities and SSO integrations. This means that authentication for trusted devices can be done in the background.
Maximize API Security with Check Point CloudGuard
Check Point CloudGuard offers transparent API discovery and schema enforcement: it then applies dual AI engines – one trained on vast volumes of malicious and benign traffic, the other continuously modeling the unique context of your applications – to automatically block threats with near-zero false positives.
Finally, CloudGuard collates all ongoing API and web application data into a unified dashboard. Reporting is made fast and efficient thanks to audit-ready logs, while Check Point’s global infrastructure provides local Points of Presence that keep latency low and maintain a high level of scalability.
Explore the CloudGuard dashboard for yourself with a demo and start unveiling the APIs within your organization.
