According to Forrester’s 2021 State of Application Security Report, a staggering 39% of all cyberattacks last year targeted web applications, and for good reason. The public-facing nature of web apps, their sprawling surface area, and the ever-present risk of code vulnerabilities make them notoriously difficult to protect—increasing the chances that attackers will find success. A study by Positive Technologies found that when penetration-tested, workloads contained an average of 22 potential security vulnerabilities, one in five of which were deemed to be of high severity. Unsurprisingly, the vulnerabilities uncovered during this study were dominated by those making up the OWASP Top 10, as shown in Figure 1.
Now, when it comes to running apps on the AWS Cloud, application developers sometimes choose to prioritize getting their workloads spun up and operational as quickly as possible, while overlooking the importance of implementing application security as a “job zero” measure. Acknowledging this tendency to overlook app security and appreciating that many organizations lack dedicated in-house security expertise, AWS fashioned its own native web application firewall (WAF) designed for ease-of-use and rapid operationalization. While quick and easy to implement, the AWS WAF requires user-configured web access control lists (ACLs) to protect resources and is intended to be heavily customized to meet the needs of a diverse range of workloads. WAF customization, however, is a process that can be a challenge, as it requires specific app and domain knowledge as well as a solid appreciation of the current threat landscape.
That’s why AWS partnered with various security vendors including F5 to offer a variety of Managed Rulesets that can be attached to AWS WAF instances, up-leveling them to mitigate a range of web app and API attack types. When AWS WAF customers attach custom F5 WAF rulesets to their WAF instances, AWS users can maintain simplicity and ease-of-use while mitigating more sophisticated threats.
F5 currently offers four unique rulesets, each of which grants protection against different threat types:
Each of these rulesets is written, managed, and regularly updated by F5 security specialists, thus enabling customers to protect their apps against evolving threats—without the need for any intervention from the AWS WAF user. Whether the rules are applied to new or existing AWS WAF instances, AWS application load balancers, or AWS CloudFront, any of the F5 rulesets can be attached in minutes from the AWS WAF console with just a few click
You can find more information about any of our rulesets on their respective AWS Marketplace Listings:
If you’re considering trying out any of our rules with your AWS WAF and have any questions or need assistance, simply sign in to ask a question on the F5 DevCentral community site. One of our technical experts or a member of our outstanding community will help you get started. You can also learn more via the supporting resources below or contact F5 sales for additional support.