In this age of sophisticated IT and advanced digital innovations, it is vital for companies to understand the online threats they might face and what the security defenses they can use to protect themselves. Historically, companies have protected their devices and user data with a network firewall, commonly known as firewall. However, as internet technology advances so do security threats. With this, firewalls alone are not enough to protect devices from modern security threats. To increase protection against malicious cyberattacks, there is a need to establish multi-pronged protection, that is by placing protection on the different layers of the network infrastructure.
The standard firewall is known to protect the transport and network layers (layers 3 and 4 of the OSI model). With the development of web application firewall (WAF), it is now possible to protect the application layer (layer 7 of the OSI model) as well. With network firewall and WAF, it is now possible to prevent broader and more sophisticated cyberattacks. The figure below shows how firewall and WAF operate given a typical day-to-day internet traffic.
Network firewalls and WAFs play a critical role in network security. Regardless of the type or size of a network, both these security measures must be in place to ensure not only the safety of sensitive information of every user, but also the functionality of the web application and the entire network infrastructures.
With such importance, we need to understand the difference between a network firewall and a WAF to assess which solution is the best for a specific type of scenario, and to set up the necessary defenses for a wide range of cyber attacks. Let’s start with their basic definitions.
Firewall
A network firewall, or simply firewall is a network security system that monitors incoming and outgoing network traffic, and permits or blocks data packets based on predefined security rules. It establishes a barrier (hence the name firewall) between your internal network (such as your local area network or LAN) and external network (such as the internet). Its main purpose is to allow traffic from a secured and trusted network, while blocking traffic from an unauthorized or untrusted network to prevent the entry of malicious entities like malwares, viruses, and other unauthorized activities.
The firewall separates a “secured area” (Higher security Zone / Inside Network) from a “less secured area” (Low-security Zone / Outside Network) and controls the communications between the two. It focuses on data transfer between these two “areas” by validating addresses and data packets entering/exiting networks. Without it, any computer with a public Internet Protocol (IP) address is accessible outside the network and is completely vulnerable to any malicious attack. A firewall can be hardware, software, or a combination of both.
WAF
A web application firewall or WAF is a form of application firewall that monitors and filters HTTP/HTTPS traffic between a web application and the Internet. It establishes a barrier that protects web applications like websites and APIs (application programming interfaces) from a variety of application-based attacks. Examples of such attacks are distributed denial-of-service (DDoS), cross-site request forgery (CSRF), cross-site scripting (XSS), structured query language (SQL) injection, file inclusion, improper system configuration, cookie poisoning, etc. In other words, WAF can block an array of malicious attacks that compromise the user-facing application layer, which is the layer where valuable user data can be easily breached.
WAF is located between external users and web applications to analyze all HTTP/S communication. Hence, it is made to detect and block malicious requests before they reach users or web applications. WAF becomes increasingly important as businesses expand into new digital initiatives, leaving new web applications and APIs vulnerable to attacks. Together with network firewall, WAF helps build a more holistic defense system against various types of cyber attacks.
Now that we clearly described the fundamentals of Firewall and WAF, let us enumerate the differences between the 2 cybersecurity technologies.
| Parameters | Firewall | WAF |
| OSI layer | 3 and 4 | 7 |
| Network Placement | Edge of network | Web applications and servers |
| Protocol coverage | Any | Web-centered: HTTP/S, XML, SOAP, etc. |
| Algorithm | Proxy Packet-filtering Stateless/Stateful | Anomaly detection Signature-based Heuristics |
| Modes of operation | Transparent modeRouted mode | Active inspectionPassive mode |
| Deployment architecture | Layer 3 gateway | Reverse proxy |
| Access control | Primary function | not |
| Threat detection | none | Signature-based Pattern anomaly App-specific anomaly |
| SSL Traffic inspection | not | ok |
| Objects protected | Network access | HTTP/HTTPS based servers and applications |
| Mitigated attacks | Attacks from less secure zones Porn or spam going into network Unauthorized logging into private LAN | SQL injection attacks XSS attacks CSRF attacks |
| DDoS protection | 3 and 4 | 7 |
| Use cases | Protect individual users and networks such as LAN or IT network Offer effective protection on the most basic level of a network Used in conjunction with WAF for increased security among multiple layers of the network | Focus on safety of applications and servers Place in zones that have contact with the internet Designed to enhance firewalls rather than replacing them |
While having similarity in definition, firewall and WAF have unique roles for network protection and are fundamentally different in their overall function. With firewalls and WAFs in place, networks are transformed into secure strongholds that protect online assets against malicious threats.