Using WAF services
WAF stands for Web Application Firewall. Each cloud provider has its implementation of a managed WAF service – that is, an application-layer firewall with capabilities to detect and mitigate common HTTP/HTTPS-based attacks against your publicly exposed web applications. Examples of application-layer attacks include injection attacks, cross-site scripting, OWASP Top 10 (injecting malicious code for the purpose of impacting data confidentiality or integrity), and various malicious bot activities (such as scrapers, scanners, and crawlers, which take network bandwidth with non-legitimate traffic).
In the following example, we see a common web application attack, where an attacker is sending a malicious script to a victim’s publicly facing web server deployed in a cloud environment to exploit a vulnerability with the intent to exfiltrate customer data.
Figure 7.2 – A sample web application attack
Here are general best...
