Glossary · simply explained

WAF (Web Application Firewall)

A WAF filters HTTP traffic before it reaches the application: it blocks attacks such as SQL injection and XSS at the edge.

A web application firewall (WAF) is a protective layer that inspects HTTP and HTTPS traffic to web applications and APIs before it reaches the application. Unlike a classic network firewall it works at the application layer: it understands requests semantically and detects attack patterns such as SQL injection, cross-site scripting or path traversal.

Modern WAFs run as a cloud service at the network edge rather than as an appliance in the data center. That way they protect applications regardless of where they run and receive current rules centrally.

How does a WAF work?

Every incoming request passes through a ruleset. Managed rules cover known attack classes and fresh vulnerabilities and are updated continuously by the provider; custom rules capture application-specific logic, such as protecting individual endpoints or exceptions for partner systems. Suspicious requests are blocked, challenged or flagged and logged.

Virtual patching is especially valuable: when a new vulnerability (CVE) becomes known, a WAF rule shields the attack path at the network edge before the affected systems themselves are updated. Today, sometimes only minutes pass between the publication of an exploit and the first attack attempts — no maintenance window is that fast.

What a WAF delivers in practice

  • Protection against the OWASP Top 10 risks such as injection, XSS and broken authentication.
  • Virtual patching of new CVEs before your own systems are updated.
  • Rule tuning against false positives so real customers are never blocked.
  • Visibility: every mitigation is logged and analysable — including for compliance evidence.

Frequently asked questions about WAF (Web Application Firewall)

How does a WAF differ from a firewall?

A network firewall filters traffic based on addresses, ports and protocols. A WAF understands the content of HTTP requests and detects attacks on application logic such as SQL injection or XSS. They complement each other: the firewall protects the network, the WAF the application.

What is virtual patching?

With virtual patching, a WAF rule shields a newly disclosed vulnerability at the network edge before the affected software itself is updated. That buys time for orderly patching — important because often only minutes pass between exploit publication and the first attack attempts.

Does a WAF also block legitimate users?

Without maintenance it can — false positives are the most common operational problem. That is why rule tuning, exception management and reviewing blocked requests are part of ongoing operations. In our managed service we take on exactly this work permanently.

Does a WAF protect APIs too?

Basic protection yes, but APIs need additional mechanisms: endpoint discovery, schema validation following a positive model and abuse detection. Modern platforms combine WAF and API protection into web application and API protection (WAAP) — one ruleset, one view of the traffic.

What does managed WAF mean?

In the managed model a provider takes over configuration, rule tuning, virtual patching and reporting of the WAF as an ongoing operation. KAEMI runs the WAF on the Cloudflare platform as a managed service — including 24/7 response and monthly reporting.

More terms

Wi-Fi 6E and Wi-Fi 7

Wi-Fi 6E opens the 6 GHz band, Wi-Fi 7 adds wider channels and multi-link: more capacity and lower latency in corporate WLAN.

Vulnerability Management

Vulnerability management detects security gaps in IT systems and ensures they are fixed before attackers exploit them. This article shows how the cycle of scanning, prioritizing and patching works, what role reachability and context play in the assessment, and where the difference to a penetration test lies.

From term to implementation: KAEMI supports you from the first assessment to the ongoing managed service.