Don't rely on WAF! A Complete Guide to Application Security Measures

Well, many companies have implemented WAF (Web Application Firewall) to protect their web applications.
However, a WAF is only an "external layer of defense" and not a panacea for security.
The ideal security measure lies in designing and implementing the application itself robustly.

In this article, we will discuss effective security measures that can be implemented on the application side without relying on a WAF. Proper implementation of these measures will enable you to build "secure applications from the start".

Why Application-Level Security Matters

While WAFs are an effective way to detect and block external attacks, the security measures of the application itself are also essential for the following reasons:

1. Multi-layered defense
   The concept of "defense-in-depth" is important for security.
   If the WAF is breached, the damage can be minimized if the application itself is robust.
2. Bypass WAF
   Sophisticated attackers are constantly looking for ways to evade WAF detection.
   If the application itself is vulnerable, the risk of damage if it slips past the WAF increases.
3. Responding to Insider Threats
   WAFs are primarily designed for external attacks, but they may not be able to respond to unauthorized access from internal users.
4. Performance Impact
   WAF deployment can introduce delays in request processing.
   If the application itself is highly secure, you can optimize the WAF inspection rules.

Let's take a look at specific application-level security measures.

SQL Injection Countermeasures

SQL injection is one of the most common and dangerous attacks.
The following measures can almost completely prevent it:

1. Using Parameterized Queries

Instead of assembling SQL queries with string concatenation, use parameterized queries using placeholders.
This prevents the input value from being interpreted as SQL code.

2. Utilizing ORM Frameworks

Instead of writing raw SQL, you can use an ORM framework (such as Hibernate, Eloquent, Django ORM, etc.) to significantly reduce the risk of SQL injection.

3. DB Accounts with the Principle of Least Privilege

When an application connects to the DB, it grants only the minimum necessary permissions to the account.
For example, for a function that only displays user information, use an account with only the SELECT permission.

Cross-Site Scripting (XSS) Measures

An XSS attack is an attack that causes a user's browser to run malicious script.
The following measures are effective:

1. Proper Output Encoding

When displaying user input, make sure to encode it properly.
In an HTML context, you convert special characters (<, >, &, ", ', etc.) into entities.

2. Implementing a Content Security Policy (CSP)

By configuring the CSP header, you can only allow script execution from allowed sources and restrict the use of inline scripts and eval().

3. Properly configure HTTP headers

You can enhance your browser's built-in protection by configuring security headers such as X-XSS-Protection and X-Content-Type-Options.

Cross-Site Request Forgery (CSRF) Measures

CSRF is an attack that forces users to make unintended requests.

1. Using CSRF Tokens

For critical operations (especially POST requests), include a randomly generated CSRF token and validate it on the server side.

2. Configuring Same-Site Cookies

Set the "SameSite=Strict" or "SameSite=Lax" attribute on your cookies to prevent cross-site requests from being sent cookies.

3. Validating the Referer Header

Validate the Referer header to ensure that the source of the critical operation is within the site (but as an auxiliary measure).

Proper Implementation of Session Management

Session management vulnerabilities can lead to serious damage, including account takeover.

1. Generating Secure Session IDs

Generate session IDs in an unpredictable format that is long enough (at least 128 bits) and complex.

2. Session Expiration Settings

Set an appropriate expiration date for sessions, and automatically disable sessions that have been idle for a long time.

3. Regenerating Sessions When Login State Changes

During important actions such as logging in, logging out, or changing privileges, regenerate the session ID.
This prevents session fixation attacks.

Input Value Validation and Output Encoding

It is fundamental not to trust all user input and to validate and encode it properly.

1. Server-Side Input Validation

All user input is always validated not only on the client side but also on the server side. Validate based on constraints such as length, format, and range.

2. HTML context-dependent encoding

Appropriate encoding for the context (HTML, JavaScript, CSS, URL, etc.) to be output.
One encoding method cannot cover all contexts.

3. Setting the Header of the Content Type

Prevent MIME-type sniffing by setting the exact Content-Type header and adding the X-Content-Type-Options header.

Implementing Secure Authentication Mechanisms

Authentication is a prime target for attackers, so they need to be especially careful.

1. Secure Hashing of Passwords

Passwords are not plaintext or simple hashes, but are hashed and salted using specialized algorithms such as bcrypt or Argon2.

2. Implementing Multi-Factor Authentication (MFA)

Adding authentication factors other than passwords (tokens, biometrics, etc.) to critical systems can significantly improve security.

3. Account Lockout Policy

Implement measures such as temporary account locks and CAPTCHA displays for continuous authentication failures to prevent brute force attacks.

Proper Error Handling

Improper error handling can compromise internal information about your application.

1. Separation of User and Developer Errors

Displays common error messages to users and logs detailed error information.
Avoid displaying debug information in production.

2. Appropriate Responses Based on Exception Types

Return the appropriate HTTP status codes and messages for different types of errors (input errors, authentication errors, internal errors, etc.).

Secure Setup and Deployment

Application configuration and deployment also have a significant impact on security.

1. Secure Management of Sensitive Information

Sensitive information such as API keys, passwords, and connection strings is not embedded in the source code, but rather uses environment variables or dedicated confidentiality management services.

2. Regular Updates to Dependent Libraries

Regularly update all dependent libraries and apply security patches. Use the vulnerability scanning tool to check for known vulnerabilities.

3. Proper Setup for Production

Production-specific security settings, such as disabling development mode, disabling debugging features, and configuring secure HTTP headers.

Summary: Continuously Improving Application Security

By making the application itself robust, you can maintain a high level of security without relying on a WAF.
Security measures are not implemented once and end, but continuously improved:

1. Security Testing: Regularly conduct static analysis tools and penetration tests
2. Developer Education: Continuously train in secure coding
3. Catch up on the latest information: Gather and update security information
4. Code Reviews: Make Code Reviews a Habit from a Security Perspective

However, in recent years, attacker methods have become more sophisticated, and in some cases, the above measures alone are not enough, so it has become the mainstream in the industry to defend applications in multiple layers.
By implementing a WAF, it is possible to implement stronger security measures, so if you are a company that would like to hear about the introduction and operation of a WAF, please contact Colorkrew.