Cloudflare named a leader by Gartner for WAAP

Gartner has recognised Cloudflare as a Leader in the 2022 “GartnerMagic Quadrant for Web Application and API Protection (WAAP)” report that evaluated 11 vendors for their ‘ability to execute’ and ‘completeness of vision’. This achievement highlights Cloudflare’s continued commitment and investment in this space as the company aims to provide better and more effective security solutions to its users and customers.

Keeping up with application security

With over 36 million HTTP requests per second being processed by the Cloudflare global network, the company gets unprecedented visibility into network patterns and attack vectors. This scale allows it to effectively differentiate clean traffic from malicious, resulting in about 1 in every 10 HTTP requests proxied by Cloudflare being mitigated at the edge by the WAAP portfolio.

Visibility is not enough, and as new use cases and patterns emerge, Cloudflare invests in research and new product development. For example, API traffic is increasing (55%+ of total traffic) and this trend isn’t expected to slow down. To help customers with these new workloads, Cloudflare’s API Gateway builds upon our WAF to provide better visibility and mitigations for well-structured API traffic for which the company has observed different attack profiles compared to standard web based applications.

Cloudflare’s continued investment in application security has helped it gain its position in this space.

Cloudflare WAAP

Cloudflare has built several features that fall under the Web Application and API Protection (WAAP) umbrella.

DDoS protection & mitigation

Cloudflare’s network, which spans more than 275 cities in over 100 countries is the backbone of its platform, and is a core component that allows mitigation of DDoS attacks of any size.

To help with this, the company’s network is intentionally anycasted and advertises the same IP addresses from all locations, allowing it to “split” incoming traffic into manageable chunks that each location can handle with ease, and this is especially important when mitigating large volumetric Distributed Denial of Service (DDoS) attacks.

The system is designed to require little to no configuration while also being “always-on” ensuring attacks are mitigated instantly. Add to that some very smart software such as the new location aware mitigation, and DDoS attacks become a solved problem.

For customers with very specific traffic patterns, full configurability of our DDoS Managed Rules is just a click away.

Web Application Firewall

Cloudflare’s WAF is a core component of its application security and ensures hackers and vulnerability scanners have a hard time trying to find potential vulnerabilities in web applications.

This is very important when zero-day vulnerabilities become publicly available as bad actors attempt to leverage new vectors within hours of them becoming public. Log4J, and even more recently the Confluence CVE, are just two examples where this behaviour was observed. That’s why the company’s WAF is also backed by a team of security experts who constantly monitor and develop/improve signatures to ensure it “buys” precious time for customers to harden and patch their backend systems when necessary. Additionally, and complementary to signatures, it’s WAF machine learning system classifies each request providing a much wider view in traffic patterns.

Cloudflare’s WAF comes packed with many advanced features such as leaked credential checks, advanced analytics and alerting and payload logging.

Bot Management

It is no secret that a large portion of web traffic is automated, and while not all automation is bad, some is unnecessary and may also be malicious.

The company’s Bot Management product works in parallel to its WAF and scores every request with the likelihood of it being generated by a bot, allowing organizations to easily filter unwanted traffic by deploying a WAF Custom Rule, all this backed by powerful analytics. Cloudflare make this easy by also maintaining a list of verified bots that can be used to further improve a security policy.

In the event of wanting to block automated traffic, Cloudflare’s managed challenge ensures that only bots receive a hard time without impacting the experience of real users.

API Gateway

API traffic, by definition, is very well-structured relative to standard web pages consumed by browsers. At the same time, APIs tend to be closer abstractions to back end databases and services, resulting in increased attention from malicious actors and often go unnoticed even to internal security teams (shadow APIs).

API Gateway, that can be layered on top of Cloudflare’s  WAF, helps organizations both discover API endpoints served by their infrastructure, as well detect potential anomalies in traffic flows that may indicate compromise, both from a volumetric and sequential perspective.

The nature of APIs also allows API Gateway to much more easily provide a positive security model contrary to the company’s WAF: only allow known good traffic and block everything else. Customers can leverage schema protection and mutual TLS authentication (mTLS) to achieve this with ease.

Page Shield

Attacks that leverage the browser environment directly can go unnoticed for some time, as they don’t necessarily require the back end application to be compromised. For example, if any third party JavaScript library used by a web application is performing malicious behavior, application administrators and users may be none the wiser while credit card details are being leaked to a third party endpoint controlled by an attacker. This is a common vector for Magecart, one of many client side security attacks.

Page Shield is solving client side security by providing active monitoring of third party libraries and alerting application owners whenever a third party asset shows malicious activity. It leverages both public standards such as content security policies (CSP) along with custom classifiers to ensure coverage.

Page Shield, just like Cloudflare’s other WAAP products, is fully integrated on the Cloudflare platform and requires one single click to turn on.

Security Center

Cloudflare’s new Security Center is the home of the WAAP portfolio. A single place for security professionals to get a broad view across both network and infrastructure assets protected by Cloudflare.

Moving forward the plan is for the Security Center to be the starting point for forensics and analysis, allowing companies to also leverage Cloudflare threat intelligence when investigating incidents.

The Cloudflare advantage

The company’s WAAP portfolio is delivered from a single horizontal platform, allowing companies to leverage all security features without additional deployments. Additionally, scaling, maintenance and updates are fully managed by Cloudflare allowing enterprises to focus on delivering business value on their application.

This applies even beyond WAAP, as, although Cloudflare started building products and services for web applications, it’s position in the network allows it to protect anything connected to the Internet, including teams, offices and internal facing applications. All from the same single platform. The company’s Zero Trust portfolio is now an integral part of its business and WAAP customers can start leveraging Cloudflare’s secure access service edge (SASE) with just a few clicks.

If looking to consolidate the company’s security posture, both from a management and budget perspective, application services teams can use the same platform that internal IT services teams use, to protect staff and internal networks.