CDNs (content delivery networks) can make your content much more performant and available for end users around the globe. But caching content at the edge does come with additional risks. That includes a much greater attack surface for malicious users to negatively impact your applications and digital assets. More hackers are targeting edge deployments, including servers and data at the network edge.
The advantages of using CDNs far outweigh the disadvantages. However, it’s still important to minimize the risks through security best practices. We’ve written extensively about the importance of monitoring CDN log data for use cases ranging from security to end user monitoring. And CDN monitoring can help you quickly find and mitigate issues like DDoS attacks.
WAFs (web application firewalls) also provide an important layer of defense for web-based applications, and can help protect your CDN origin servers as well as content cached at the edge.
This post will cover:
- The basics of WAFs—and how they can help protect your CDN distributions
- The importance of collecting and monitoring WAF logs
- How Hydrolix for AWS can help you monitor and protect resources at the edge
The Basics of WAF
WAFs are an important security tool and a critical layer of defense against many types of application layer attacks. This includes denial of service (DoS and DDoS) and cross-site scripting (XSS). WAFs operate at the level of HTTP requests, distinguishing them from network firewalls, which filter network traffic.
A WAF works by acting as a reverse proxy between a client and a server. It filters incoming HTTP requests and blocks any traffic that violates WAF rules. WAFs also generate request logs—and they can potentially result in huge volumes of log data if your application has a lot of traffic.
A WAF is only effective if you configure it properly. That means adding rules that specify how the WAF should handle an incoming request and whether it should be blocked. Some WAFs come with built-in rules, and WAFs like AWS WAF include third-party vendors that can implement additional pre-configured rules for your application. It’s also typical to include custom rules that are specifically tailor-made for your application.
At the very least, WAFs should implement rules that address the OWASP top ten. OWASP’s (Open Worldwide Application Security Project) list includes what the ten most critical security risks for web applications.
Why WAFs are Important for CDNs
By distributing digital assets at the edge, CDNs can make your content more resilient against certain kinds of attacks. For example, the distribution of content makes it harder for DDoS (distributed denial of service) attacks to impact your services. In the case of DDoS attacks, if one edge server is impacted, then traffic will be redistributed to other edge servers.
However, the distributed nature of CDNs can lead to potential headaches when it comes to security. Instead of just protecting digital assets at a single point of origin, that content also has to be protected wherever it’s cached. And the global nature of this distribution means taking extra steps to minimize the attack surface as much as possible.
WAF can help improve security for all your web applications, and when it comes to CDN content, it provides an extra layer of protection against attacks like DDoS. While CDN providers enable robust security measures to protect against issues like cache poisoning, hackers can still exploit zero day vulnerabilities, improperly configured applications, and web assets that are served by custom-built CDNs. WAFs can also include CAPTCHA challenges and protection against bots that are trying to overload servers, scrape content, or probe web assets for vulnerabilities.
WAF Logs Are a Valuable Source of Security Data
Because WAFs can generate a huge volume of logs, it may be tempting to discard them after a short period of time—or even minimize collecting them. However, they provide a valuable source of security and compliance data, and there are many reasons why it’s important to retain them. Let’s take a look at some of these reasons:
- Tracking malicious activity over time: WAF logs provide a record of all HTTP requests, including malicious attempts. Malicious actors often use a low and slow approach. Ideally you should be retaining and monitoring WAF logs over a long period of time.
- Fine-tuning WAF configuration: While many vendors offer pre-built WAF rules, these rules need to be tailored to fit the needs of your web applications. And WAFs can easily be misconfigured. Even WAFs that use machine learning to automatically tune rules should be monitored. With WAF logs, you can easily see whether suspicious requests are getting through, and whether there are false positives that are blocking legitimate requests.
- False positives: Misconfigured rules or code deployments that change how your applications work can lead to false positives. By monitoring WAF logs, you can see if some rules appear to be triggering abnormal amounts of alerts, then determine if it’s due to a misconfigured rule or an attack.
- Forensic analysis: If a malicious attempt is successful, you’ll need to do forensic analysis to find the root cause. This will likely involve looking at many different kinds of logs, including WAF, to determine how and when the breach occurred. Considering that breaches can often take months or even years to detect, it’s important to keep WAF logs long-term.
- Compliance: Some compliance frameworks require WAFs. You can use WAF logs to demonstrate that your web applications are in compliance as needed.
Monitoring WAF Logs
Considering that WAFs can generate huge volumes of log data, what’s the best way to collect, monitor, and analyze that data, especially if you want to store it long-term?
Hydrolix for AWS is an origin-to-edge observability solution that allows you to monitor WAF logs. With Hydrolix for AWS, you can monitor CDN logs and WAF data, giving you a comprehensive view of how users are interacting with your web distributions and digital assets. Hydrolix is a real-time data platform that also powers TrafficPeak, an observability solution running on Akamai Connected Cloud.
With Hydrolix for AWS, you get all of the following benefits when it comes to WAF data:
- Real-time analytics of all your WAF logs and the ability to add alerts based on specific thresholds.
- Cost-effective historical analytics and fifteen months of always “hot” data retention by default. This makes it easier to retain your data for compliance, tracking malicious activity over time, and forensic analysis.
- The ability to aggregate WAF data into summary tables in real time for queries. Summary tables provide cost-effective, high-performance queries for a wide range of use cases, including real-time dashboards. All while allowing you to keep the underlying raw data so you can drill down whenever you need it.
- Cost-effective, simple pricing that makes it easy to maximize the value of your WAF data without breaking the budget.
Get Started with Hydrolix for AWS
You can start ingesting data and getting insights from Hydrolix for AWS in under twenty minutes. Follow along with the Getting started instructions in our docs and sign up for a 7-day free trial.
