Application firewalls protect applications at the layer 7 level where most attacks occur. Akamai's application firewall inspects requests and responses for malicious content and patterns to protect against attacks like SQL injections. It can log or block activities against configurable policies and protects organizations against application layer attacks that propagate over HTTP and HTTPS.

1. Application Firewall (WAF)
onference 2013

2. bercrime Landscape in 2013
…and
easier t
carry ou
e
re
ed...

3. From Network to Application Layer
Application Layer
Where
increasing
number
of
a2acks
(Layer 7)
are
focused
Target
of
Network Layer Tradi,onal
(Layers 3/4) DDoS
A2acks

4. pplication Firewall Highlights
ates at the network edge – over 100,000 servers
cts requests and responses for malicious content and info le
cts packets to protect against attacks such as SQL Injections
s-Site Scripts
gurable to log or block activities against policy
cts organizations against application layer attacks propagate
P and HTTPS
les compliance with PCI DSS 1.2 section 6.6
des advanced rate controls (behavioral based protections)
agates quickly (~30 minutes)
gured via portal

5. ecurity Solutions 2.0
urity Rule Update
le Set 2.2.6
CRS support
Common Rules
n Akamai’s unique view
% of internet traffic
d Rate Controls
ID; Client-IP+User-Agent
grade Wizard

7. Appendix & Details

8. Intelligent Platform™
g Network Layer Attacks at the Edge
ayer attack mitigation Examples of attacks types dropped
otection is “always on” at Akamai Edge
80 (HTTP) or Port 443 (HTTPS) traffic § UDP Fragments
n Platform § ICMP Floods
r traffic dropped at the Akamai Edge § SYN Floods
k traffic never makes it onto Platform
§ ACK Floods
mer not charged for traffic dropped at Edge
s attack requests without requiring identification § RESET Floods
s CNAME onto Akamai Intelligent Platform § UDP Floods
ttacks through massive scale
s average throughput; up to 8Tbps
on of HTTP request traffic across 100,000+
,100+ networks
ting, added latency, or point of failure

9. Rules
plication Firewall
tion The Result
Custom Rules implemented § New rule logic can be built to
mai metadata written by specific use cases for the cus
i Professional Services § Rules can be built that execut
are created and managed in one or more baseline rules or
mer portal control rules match
are then associated with § Output of application vulnerab
l policies and deployed with products can be implemented
n 45 minutes “virtual patches”
§ Advanced piping to user valid
actions can be achieved (prio

10. Rules
plication Firewall
tion The Result
Custom Rules implemented § New rule logic can be built to
mai metadata written by specific use cases for the cus
i Professional Services § Rules can be built that execut
are created and managed in one or more baseline rules or
mer portal control rules match
are then associated with § Output of application vulnerab
l policies and deployed with products can be implemented
n 45 minutes “virtual patches”
§ Advanced piping to user valid
actions can be achieved (prio

11. e Rate Controls
s Behavior Detection
y number of requests per § Statistics collected for 3 reque
d against a given URL o Client Request – Client to Akama
ols requests based on behavior o Forward Request – Akamai Serv
n – not request structure o Forward Response – Origin to A
client IP address, session ID, cookies, etc.
§ Statistics collected allow us to
ure rate categories to
large proxies and pick out a m
request rates against digital
user hiding behind a proxy
ties
te rate-based DDoS attacks § Statistics collected allow for dete
of pathological behavior by a clie
o Request rate is excessive for an
o Requests causing too many Orig

12. e Rate Controls
s Behavior Detection
y number of requests per § Statistics collected for 3 reque
d against a given URL o Client Request – Client to Akama
ols requests based on behavior o Forward Request – Akamai Serv
n – not request structure o Forward Response – Origin to A
client IP address, session ID, cookies, etc.
§ Statistics collected allow us to
ure rate categories to
large proxies and pick out a m
request rates against digital
user hiding behind a proxy
ties
te rate-based DDoS attacks § Statistics collected allow for dete
of pathological behavior by a clie
o Request rate is excessive for an
o Requests causing too many Orig

13. y Monitor (1 of 3)
Timeline of Requests
by Hour
Visual Display of
Requests by
Geography Requests by
WAF Rule ID
Requests Requests
by WAF Message by WAF Tag

14. y Monitor (2 of 3)
Multiple ways
to display
request statistics

15. y Monitor (3 of 3)
Requests by
City
Requests by ARLs being
Client IP address attacked