Verizon Digital Media Services is pleased to announce that our Cloud-based Web Application Firewall (WAF) is now in production and commercially available for our customers running on the ADN (Accelerate) and CAN (Transact) CDN platforms. Our declaration comes after an extensive engineering effort by a talented team of security-oriented developers, 4+ months of beta testing and rigorous evaluation by a mix of customers, Verizon’s security professionals and the ModSecurity experts at Trustwave.
WAF is a key component of Verizon’s DEFEND suite of web security solutions. It is based on the world’s most deployed web application firewall engine, ModSecurity, and is designed to provide a high degree of protection against cybercrime, hacktivism, and cyber espionage. Besides providing protection against common application level attack categories such as Cross-site Scripting, SQL Injection etc., our WAF provides protection against publicly known vulnerabilities for specific applications and platforms. Through its rich set of features, the WAF can protect customers against attacks designed to take over websites, steal business critical information and more.
Our ModSecurity-based WAF was built to address the web application security needs of organizations large and small. Customers are able to self-configure and use our WAF in both simple and complex ways — without the need for professional services. It inspects HTTP/S traffic in order to identify and protect against malicious payloads & specific attacks. Both traditional/signature and anomaly scoring modes of ModSecurity are supported — the latter allowing customers to set an anomaly score threshold appropriate for their security requirements and risk tolerance. This enables customers to significantly reduce the likelihood of blocking a normal HTTP request due to “false positives”.
And our Rules Engine is used to set almost any combination of rules to tell WAF precisely what traffic to inspect against what rules — a level of granular control not seen before with Cloud-based WAFs.
As previously announced, the Verizon WAF sets a new standard for reaction time to attacks: Once a new exploit has been identified, WAF rules can be selected and/or updated and deployed worldwide within minutes. The Cloud-based Verizon WAF delivers the most comprehensive application level security by employing two distinct ModSecurity rule sets from OWASP and Trustwave. And a tightly integrated content delivery network and WAF command-and-control plane give customers more controls and tools to block and fend off attackers.
At Verizon we believe that effective Web Site Security starts with a secure DNS infrastructure, and also requires the use of technologies that can protect against DDoS attacks (anti-DDoS), Web application attacks (WAF), and Direct to origin attacks (Origin Cloaking). These key capabilities are augmented with additional offerings used to encrypt/ protect access to your content, such as X.509 (TLS) certificates, and Token-based Authentication.
To learn more about our WAF contact Verizon Sales:
Toll Free (USA): +1-877-EDGE-CDN
By Phone: +1-310-396-7400