Defense-in-depth strategy combined with WAF and Firewall: comprehensive protection of corporate networks

What is defense-in-depth? Basic Security Concepts

Defense-in-depth is a security strategy that arranges multiple security measures in layers to prevent attacks from the other even if one layer of defense is breached.

This is likened to the defense of a castle:

• Outer moat (boundary firewall)
• Castle walls (internal segmentation)
• Watchtower (IDS/IPS)
• Gatekeeper (WAF)
• Security Guard (Endpoint Security)

Even if an attacker breaks through one defense, they will face the next layer, making it difficult to achieve their ultimate goal.

WAF vs. Firewall: Coverage of Each

To build an effective defense-in-depth, it's important to first understand the characteristics and coverage of each security measure.

Firewall Coverage

Firewalls primarily operate at the network level (layers 3-4 of the OSI reference model) and provide defenses such as:

• Traffic filtering: Communication control based on IP address and port number
• Network segmentation: Logical isolation of internal networks
• Unauthorized access blocking: Blocking unauthorized connections
• DoS/DDoS attack mitigation: Limiting large volumes of traffic
• Abnormal communication detection: Identification of unusual communication patterns

WAF Coverage

The WAF operates at the application level (layer 7 of the OSI reference model) and provides defenses such as:

• Web application attack defense: SQL injection, XSS, CSRF, etc.
• Detailed analysis of the content of the request: Inspection of parameters, headers, cookies, etc.
• Session management: Prevent unauthorized session operations
• Control bot traffic: Prevent unauthorized scraping and brute-force attacks
• Prevent leakage of sensitive information: Block the external transmission of sensitive data

Defense-in-depth architecture with WAF and Firewall

To effectively combine a WAF and a Firewall, the following architectures are considered:

1. Boundary Defense Layer: Domain Firewall:

• Placed at the entrance from the Internet
• Basic traffic filtering
• Blocking obvious unauthorized access
• Closure of unused ports

2. Application Defense Layer WAF:

• Placed in the front of the web application
• Detailed inspection of HTTP requests
• Web application-specific attack defense
• Blocking suspicious parameters and payloads

3. Internal Segment Defense Layer Internal Firewall:

• Placed in front of critical systems (e.g., database servers)
• Restrict access based on the principle of least privilege
• Prevents lateral movement
• Detect and block abnormal communications

4. Data Protection Layer Database Firewall/WAF:

• Direct access control to databases
• Detection of external transmission of sensitive data
• Blocking suspicious database queries

This multi-layered structure increases the likelihood that if an attacker breaches one defense, it will be stopped by the next.

Defense-in-depth Implementation Example: Configuring in a Cloud Environment

Let's take a look at an example of implementation in a cloud environment. Here's an example of a defense-in-depth architecture on AWS:

1. Layer 1: AWS Shield + AWS WAF (Perimeter Protection)
   • DDoS attack mitigation
   • Basic web application attack defense
2. Tier 2: Security Groups (Firewall equivalent)
   • Instance-level traffic control
   • Allow communication based on least privilege
3. Layer 3: Network ACLs (Additional Network Firewall)
   • Subnet-level access control
   • Stateless filtering
4. Layer 4: Internal WAF/Reverse Proxy
   • Detailed traffic inspection to the application
   • Content filtering
5. Layer 5: Database Security
   • Access control combined with IAM
   • Data protection with encryption

Best Practices for Implementing Defense-in-Depth

Here are some best practices for implementing a combined WAF and Firewall defense-in-depth implementation:

1. Adopt Zero Trust Principles

• Reject all communications by default
• Allow only explicitly authorized communications
• Verify all communications, both internal and external.

2. Proper Traffic Visibility and Monitoring

• Integrated analysis of both Firewall and WAF logs
• Establish a baseline for anomaly detection
• Real-time monitoring and notification system

3. Ensuring Consistency in Security Policies

• Adjust WAF and Firewall rules to ensure no conflicts
• Unified management of security policies
• Establish a change management process

4. Regular Vulnerability Scanning and Penetration Testing

• Regularly validate the effectiveness of defense-in-depth
• Testing based on attack scenarios
• Respond quickly to discovered vulnerabilities

5. Preparing an Incident Response Plan

• Documentation of response procedures in the event of a security breach
• Clarification of the person in charge and the liaison system
• Regular training and review

WAF and Firewall Integration to Improve Detection Capabilities

Integrated analysis of WAF and Firewall logs enables more advanced threat detection:

1. Detecting Attack Signs

• Port scan detection on Firewall
• Increased access to specific paths in the WAF after that
• Early detection of attack precursors by combining both information

2. Multi-stage attack visibility

• Get a complete picture of your attack
• Identification of the attacker's IP address, usage techniques, and targets
• Attack chain analysis and countermeasures

3. Reducing False Positives

• Correlate information from multiple security layers
• More accurate alert generation
• Reduced burden on operations teams

Summary: For Effective Defense-in-Depth

Defense-in-depth combining WAF and Firewall is an effective defense strategy against modern cyber threats. To summarize the points:

1. Don't rely on a single measure: Combine WAF, Firewall, and other security measures
2. Understand and leverage the characteristics of each layer: Firewall and WAF each offer protection at different layers
3. Perform integrated monitoring and analysis: Correlate information from multiple security layers
4. Continuous Optimization and Updates: Adapting to the evolving threat landscape
5. Secure Human Resources and Expertise: Leverage SOC Services

Colorkrew Security's SOC services provide one-stop support for the design, deployment, and operation of defense-in-depth defenses, including WAFs and Firewalls.

We provide comprehensive services from optimal security architecture design on major cloud platforms such as AWS, Azure, and Google Cloud, to 24/365 security monitoring and incident response.

If you're an organization that is struggling to build and operate defense-in-depth, or if you're looking to build a more robust security posture, Colorkrew is here to help.

With our extensive experience and expertise, we can help you build a solid security foundation that supports your business.