Web Application Firewall

Web Application Firewall

 

Block attacks and patch web application vulnerabilities.

 

Industry-leading cloud service for scalable, simple and powerful protection of web applications

 

“We are excited that Qualys WAF will allow us to act quickly and respond to threats by using the one-click virtual patching feature to remediate active vulnerabilities.”

 

David Cook Chief Security Officer at Jive Software

 

Highlights

 

True, integrated web app security

 

Qualys gives you a single, interactive console for web application vulnerability detection (Qualys WAS) and protection (Qualys WAF) for seamless identification and mitigation of risks — for a dozen apps or thousands. Scan your web apps using WAS, and deploy virtual patches for confirmed vulnerabilities to WAF. You can manage it all from a centralized portal. Security teams can now secure their web apps without having to involve network security teams — lowering operational complexity and costs.

Cloud agility

 

With no special hardware to buy nor maintain, Qualys WAF’s virtual appliance can be deployed and scaled up quickly on premises using VMware, Hyper-V or Docker; and in public cloud platforms, such as AWS, Azure or Google Cloud Platform. Application traffic stays in your environment to minimize latency and maintain control. WAF continuously communicates with the Qualys Cloud Platform, tracking configuration changes and sending it the latest security events.

 

Full visibility into firewall operation

 

WAF gives you complete visibility into its data for continuous monitoring, risk assessments and remediation plans. A dashboard summarizes website traffic information and security event trends. Detailed threat information lets you assess severity and adjust security settings. Search for suspicious activity and drill down into threat data to gain actionable insights. WAF continuously indexes security events into your local Elastic search or Splunk clusters, making your data instantly discoverable.

Strong rules, flexible control

 

WAF protects your web apps using security policies backed by Qualys’ security intelligence, and one-click responses to security events. You can address your own security needs with simple, customizable and reusable policies and rules. Qualys’ out-of-the-box policies are designed for popular platforms such as WordPress, Joomla, Drupal, Outlook Web Application and Sharepoint. It also includes generic templates for unknown applications and frameworks.

 

Prevent breaches by blocking attacks on web server vulnerabilities

 

You can’t protect – nor defend yourself from – what you don’t know is in your network, like unapproved devices and unauthorized software. Qualys gives you full horizontal visibility of all hardware and software, scaling up to millions of assets – on premises, in cloud instances and mobile endpoints.

 

• Protect cloud apps
  • Quickly and easily protect apps in public or private clouds by deploying Qualys Virtual Firewall Appliances alongside your web apps. No need to buy nor maintain special hardware
  • Add as many applications as necessary as often as you need, as these virtual machines scale seamlessly.
  • Ensure high performance and availability of business-critical web apps thanks to built-in load balancing and application monitoring.
  • Enforce applications’ SSL/TLS layer thanks to Qualys WAF’s offloading capability

 

• Adopt a new approach for web app security with Qualys WAF’s adaptive policies, which are always up to date and don’t require specialized expertise, nor complex rulesets to configure and maintain
  • Describe the security level for each application with a few clicks, and Qualys WAF automatically decides what to do in different situations
  • Simplify Qualys WAF configuration with Qualys generic templates, or with built-in security policies for popular platforms such as WordPress, Joomla, Drupal and Outlook Web Application, Sharepoint

 

• Defend yourself from current and future threats with customizable protection
  • Block a wide range of attacks such as Cross-Site Scripting (XSS), SQL injection, Remote Command Execution, XXE and more with native protection. As new threats emerge, Qualys’ security experts update WAF’s rules, which are then downloaded and spotted by the proprietary detection engine.
  • Tailor how Qualys WAF handles different types of threats, from simply logging the event to actively blocking it.
  • Create custom security rules to address specific security needs of your application and reduce the attack surface.
  • Maintain website uptime by complementing network DDoS defenses with controls over applications’ latency.

 

• Protect your users against clickjacking, Cross-Site Scripting (XSS), and other browser-based attacks with Qualys WAF’s security features for modern web browsers
• Integrate WAF API into your DevSecOps environment and protect web servers hosting the apps you’re rapidly and iteratively developing and deploying

 

Benefit from native, deep integration between WAF and WAS

 

Empower security professionals to rapidly discover and mitigate critical security concerns. With the new ScanTrust feature, Qualys WAF combines with Qualys WAS to provide true visibility for your web applications: Detect with WAS, protect with WAF and get scalable scanning, false-positive reduction and one-click patching to web apps.

• From a single console, use WAS to detect vulnerabilities in web apps, including mobile and IoT apps, and – with one click – mitigate them with WAF virtual patches
• Leverage the creation of these virtual patch rules to fine-tune policies, remove false positives, and customize security rules
• Avoid the redundancies and gaps that come with trying to glue separate, siloed solutions. Reduce operating costs by reducing staff
• Evaluate and create exceptions to web events to better prioritize and mitigate vulnerabilities by combining WAF rules and policies with WAS scan data
• Integrate web app scan data via a rich, extensive set of APIs into other security and compliance systems, such as firewalls, and SIEM and ERM solutions

 

Simplify IT compliance

 

It’s easier than ever for employees to bypass their IT department and adopt web apps, a trend that generates significant security and compliance risks. Simultaneously, the quantity and complexity of government regulations, industry mandates and internal policies that impact InfoSec technologies and processes continues to grow. WAF can help you comply.

• Address mandates such as PCI DSS 6.6 that require app firewalls
• Comply with policies and regulations that prohibit access to certain web applications or information from particular locations by restricting access from specific countries or network address blocks
• Prevent transmission of sensitive data by blocking users’ ability to upload or download content or files in unapproved or suspicious formats

Visualize and report

 

You need an easy, intuitive way of understanding the security of all your web applications at once. WAF gives your security team complete visibility into its data for continuous monitoring, risk assessments and remediation paths. WAF tools for visualization and reporting include a graphics-rich dashboard, interactive insights and detailed information on each threat and ways to address it.

• Spot unusual patterns in the dashboard, which shows summarized website traffic information and trends of WAF security events, including when they occurred and where they originated
• Quickly assess severity and adjust your security settings for aggressive mitigation or to minimize false positives by leveraging detailed information on each threat detected by WAF
• Use extensive filtering and dynamic search capabilities to identify suspicious activity, drill down into threat data and the Qualys Knowledge Base, and gain actionable insights into the threat landscape

 

Powered by the Qualys Cloud Platform

 

Single-pane-of-glass UI

See the results in one place, in seconds. With AssetView, security and compliance pros and managers get a complete and continuously updated view of all of their IT assets — from a single dashboard interface. Its fully customizable and lets you see the big picture, drill down into details, and generate reports for teammates and auditors. Its intuitive and easy-to-build dynamic dashboards aggregate and correlate all of your IT security and compliance data in one place from all the various Qualys Cloud Apps. With its powerful elastic search clusters, you can now search for any asset – on-premises, endpoints and all clouds – with 2-second visibility.

 

Centralized & customized

Centralize discovery of host assets for multiple types of assessments. Organize host asset groups to match the structure of your business. Keep security data private with our end-to-end encryption & strong access controls. You can centrally manage users’ access to their Qualys accounts through your enterprise single sign-on (SSO). Qualys supports SAML 2.0-based identity service providers.

 

Easy deployment

Deploy from a public or private cloud — fully managed by Qualys. With Qualys, there are no servers to provision, no software to install, and no databases to maintain. You always have the latest Qualys features available through your browser, without setting up special client software or VPN connections.

 

Scalable and extensible

Scale up globally, on demand. Integrate with other systems via extensible XML-based APIs. You can use Qualys with a broad range of security and compliance systems, such as GRC, ticketing systems, SIEM, ERM, and IDS.