I have been in fair amount of discussions with management on the need for WAF, and IPS; they often confuse them and their basic purpose. It has been usually discussed after a pentest or vulnerability assessment, that if I can’t fix this vulnerability — shall I just put an IPS or WAF to protect the intrusion/ exploitation? Or, sometimes they are considered as the silver bullet to thwart off the attackers instead of fixing the bugs. So, let me tell you — This is not good!

The security products are well suited to protect from something “unknown” or something that you have “unknowingly missed”. It is not a silver bullet or an excuse to keep systems/ applications unpatched.

Security shouldn’t be an AND/OR case. More the merrier only if they have been configured properly and each one of the product(s) has a different role to play under the flag of defense in depth! So, while I started this article as WAF vs. IPS — it’s time to understand it’s WAF and IPS. The ecosystem of your production environment is evolving and so is the threat landscape — it’s more complex to protect than it was 5 years ago. Attackers are running at your pace, if not faster & a step ahead. These adversary as well piggy-back existing threats to launch their exploits. Often something that starts as simple as DDOS to overwhelm your networks, concedes in an application layer attack. So, network firewall, application firewall, anti-malware, IPS, SIEM etc. all have an important task and should be omnipresent with bells and whistles!

Nevertheless, whether it’s a WAF or an IPS; each has it’s own purpose and though they can’t replace each other, they often have gray areas under which you can rest your risks. This blog will try to address these gray areas, and the associated differences to make life easier when it comes to WAF ( Web Application Firewall) or IPS ( Intrusion Prevention System). The assumption is both are modern products, and the IPS have deep packet inspection capabilities. Now, let’s try to understand the infrastructure, environment and scope of your golden eggs before we can take a call which is the best way to protect the data,

1. If you are protecting only the “web applications” running on HTTP sockets, then WAF is enough. IPS will be cherry on cake.
2. If you are protecting all sorts of traffic — SSH, FTP, HTTP etc. then WAF is of less use at it can’t inspect non HTTP traffic. I would recommend having a deep packet inspection IPS.
3. WAF must not be considered as an alternative for traditional network firewalls. It works on the application layer and hence is primarily useful on HTTP, SSL (decryption), Javascript, AJAX, ActiveX, Session management kind of traffic.
4. A typical IPS does not decrypt SSL traffic, and therefore is insufficient in packet inspection on HTTPS session.
5. There is wide difference in the traffic visibility and base-lining for anomalies. While WAF has an “understanding” of traffic — HTTP GET, POST, URL, SSL etc. the IPS only understands it as network traffic and therefore can do layer 3/4 checks — bandwidth, packet size, raw protocol decoding/ anomalies but not the GET/ POST or session management.
6. IPS is useful in cases where RDP, SSH or FTP traffic has to be inspected before it reaches the box to make sure that the protocol is not tampered or wrapped with another TCP packet etc.

Both the technologies have matured and have many gray areas of working but understand that WAF knows and capture the contents of HTTP traffic to see if there is a SQL injection, XSS or cookie manipulation but the IPS have very little or no understanding of the underlying application, therefore can’t do much with the traffic contents. An IPS can’t raise an alarm if someone is getting confidential data out, or even sending a harmful parameter to your application — it will let it through if it’s a valid HTTP packet.

Now, with the information I just shared, try to have a conversation with your management on how to provide the best layered approach in security. How to make sure the network, and application is resilient to complex attacks and threats lurking at your perimeter, or inside.