Edgio WAAP Rules – Creating Order Out of Chaos

My day is filled with questions from current and potential customers. One that I love answering is what makes our web application and API protection (WAAP) and our security rulesets so accurate. Accuracy is critical when considering the onslaught of new attack vectors and vulnerabilities occurring over the last few years. In fact, the Cybersecurity and Infrastructure Security Agency (CISA) recently added 66 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, and new CVEs have grown over 25% YoY in 2022. CISA isn’t the only one concerned about security and performance. According to a recent survey, businesses want a reduction in false positives, false negatives, alert fatigue, and improved security management. So what makes Edgio WAAP Rules more effective? At a high level, it has to do with the special order in which we run our WAAP rules and our hybrid signature and anomaly scoring mode with the Managed Rules. We perform these processes within milliseconds via our homegrown waflz engine to provide security without sacrificing performance. Let’s dive into this in greater detail.

Peeling Back the Onion

Before we review the inner workings of our Managed Rules, let’s look at the different layers (pun intended) of the protections in our WAAP. Every layer of the WAAP plays an important role. The information below provides an overview of its functions.

Access Control Rules

Access control rules provide the ability to create modular allowlists, denylists, and positive-security access lists to control access to protected sites by IP address, anonymous proxy, country, ASN, geo-region code, user agent, cookie, referrer, URL, HTTP request method, content type, file extension, file size, and request headers.

Rate Limiting Rules

Rate limiting rules restrict the flow of HTTP requests to an application protected by the WAAP to prevent malicious or unintentional application DDoS traffic and prevent a customer’s application servers from being overloaded with requests from attacks or unplanned traffic spikes.

Bot Manager Rules

Bot manager detects both good and bad bots. It provides multiple options to mitigate unwanted automation or bad bots and prevents them from reaching your applications. This protects your site from malicious bots performing credential stuffing, scraping your content, carding, spamming your forms, launching DDoS attacks, and committing ad fraud.

Custom Rules

Custom rules put our powerful WAAP engine in your hands to create your own security rules. Malicious traffic is identified using a combination of variables (i.e., request headers, body, query, method, URL, cookie, etc.). This method provides added flexibility for threat detection and enables you to filter for specific malicious requests and take action to mitigate them. Custom threat identification combined with rapid testing and deployment enables you to quickly address long-term and zero-day vulnerabilities by creating virtual patches.

Managed Rules

Edgio’s Managed Rules identify malicious traffic via a proprietary ruleset managed by Edgio. Managed Rules consist of over 500 rules spread across three categories:

1. Edgio Proprietary Rules.
2. Advanced application-specific rules.
3. Generic OWASP rules.

This comprehensively collects various security policies and rules for different attack categories and applications. When performing a threat assessment, each Managed Rule can be customized to prevent false positives by excluding certain variables (i.e., cookies, headers, and request parameter/query string). As you can see, our WAAP rules have many layers, and within each layer, there could be anywhere from dozens to hundreds of rules and conditions our WAAP has to run. Each rule presents a probability of introducing false positives and impacting performance. Complicating matters is that the Edgio WAAP provides unique abilities to run in Dual WAAP mode, where you can run two versions of the security configurations for your production traffic concurrently for access control rules, custom rules, and managed rules. We will add additional protection layers as we continue to enhance our security solutions. Which raises the question, how do we ensure our WAAP processes millions of requests accurately and efficiently amidst the chaos of all these capabilities and rules?

Creating Order Out of Chaos

Besides having a powerful homegrown waflz engine specifically designed to scale in a high-performance multi-tenant environment, the key is creating a proper order of operations to run the WAAP most efficiently and effectively. To accomplish this, our WAAP runs its different layers of rule modules in the following sequence:

1. Access Control Rules: All requests are filtered by a static set of customer configured allow/deny/access lists consisting of the previously mentioned variables. The WAAP drops any request matching the deny list, preventing any unwanted traffic from being processed further.
2. Rate Limiting Rules: Requests passing the access control rules are then tracked by the rate-limiting rules, which track the request for each client within a time window specified by the configuration. The WAAP drops requests exceeding a particular request rate threshold, further cutting the request volumes from proceeding to the next step.
3. Bot Manager Rules: Each request reaching this step is inspected by our ML platform to determine whether they are bot-based on a combination of request signatures and behaviors. Any malicious bot requests can be mitigated here via various means including browser challenge, custom response, or captcha. Most attacks are made via automated clients, making the bot manager an effective solution to mitigate these attacks and further reduce the volume of requests that need to be processed by subsequent rule modules.
4. Custom Rules: At this step, the WAAP inspects the request using various custom filters created by customers to detect and mitigate unwanted requests. This can include any application-specific rules customers can deploy in real time to mitigate zero-day vulnerabilities without waiting for the managed WAAP ruleset to be updated. This is an invaluable tool to gain visibility and control over specific attacks. Because of the specificity of the custom rules, they take precedence over the Edgio-managed rules and will process the requests before passing them to the final layer.
5. Managed Rules: Any request reaching this stage is processed by the Managed 500+ rules across Edgio proprietary, advanced application-specific, and generic OWASP categories.