B. Increase WAF may mark the client as suspicious and log full transactions for a Logging for period of time regardless of whether the client triggers any alerts. Client C. Email Alerts WAF may send out email alerts to notify security personnel. D. Request WAF may export alert meta-data and alter the transaction to add new Header request headers. This data may be used to share data with the Tagging web application or fraud detection systems. E. Notify WAF may notify networking infrastructure components such as a Network Firewall and make policy changes to temporarily block further access Infrastructure from the client source IP address. Active Response Active response actions are ones that a WAF may take that apply disruptive actions to either the current or future transactions. Your security policy may require specific responses once an attack is detected. Those responses depend on the deployment mode used and attack detected as described in the table. A. TCP Reset WAF will send spoofed TCP RST/FIN packets in an Network placement is attempt to forcefully terminate the connection. critical for effectiveness. B. Block the WAF may temporarily block the client IP address from Blocking based on client IP Client accessing the application. address may deny Source legitimate users who are Address using the same IP address. Attackers may also easily use a different IP address. C. GeoLocation WAF may utilize GeoLocation data to either deny or May decide to block Restrictions allow access to the application under certain situations. access from locations with high fraud rates or to only allow certain locations when under heavy attack. D. Redirection WAF may issue HTTP Redirection response that will Error pages could provide to Error send the user to an informative web page describing the detailed data for Pages reason for the blocking. resolution by contacting support or helpdesk. E. Forcing WAF may apply transaction delays to slow down May allow more time for Transaction attacker traffic. incident response Delays personnel to respond. F. Spoofing WAF may alter response data to simulate a successful May allow more time for Successful attack. incident response Attack personnel to respond. Responses G. Proxying WAF may selectively proxy attacker traffic to an isolated May allow more time for Traffic to honeypot system. incident response
B. Increase Logging for Client WAF may mark the client as suspicious and log full transactions for a period of time regardless of whether the client triggers any alerts. C. Email Alerts WAF may send out email alerts to notify security personnel. D. Request Header Tagging WAF may export alert meta-data and alter the transaction to add new request headers. This data may be used to share data with the web application or fraud detection systems. E. Notify Network Infrastructure WAF may notify networking infrastructure components such as a Firewall and make policy changes to temporarily block further access from the client source IP address. Active Response Active response actions are ones that a WAF may take that apply disruptive actions to either the current or future transactions. Your security policy may require specific responses once an attack is detected. Those responses depend on the deployment mode used and attack detected as described in the table. A. TCP Reset WAF will send spoofed TCP RST/FIN packets in an attempt to forcefully terminate the connection. Network placement is critical for effectiveness. B. Block the Client Source Address WAF may temporarily block the client IP address from accessing the application. Blocking based on client IP address may deny legitimate users who are using the same IP address. Attackers may also easily use a different IP address. C. GeoLocation Restrictions WAF may utilize GeoLocation data to either deny or allow access to the application under certain situations. May decide to block access from locations with high fraud rates or to only allow certain locations when under heavy attack. D. Redirection to Error Pages WAF may issue HTTP Redirection response that will send the user to an informative web page describing the reason for the blocking. Error pages could provide detailed data for resolution by contacting support or helpdesk. E. Forcing Transaction Delays WAF may apply transaction delays to slow down attacker traffic. May allow more time for incident response personnel to respond. F. Spoofing Successful Attack Responses WAF may alter response data to simulate a successful attack. May allow more time for incident response personnel to respond. G. Proxying Traffic to WAF may selectively proxy attacker traffic to an isolated honeypot system. May allow more time for incident response
WAFEC%202%20outline%20-%20Barnett%20-%20Shulman%20020313.docx