Need indicators
This capability is usually relevant when these signals appear in the operating environment.
Internet-exposed applications.
Legacy apps that cannot be fixed quickly.
Recurring injection or exploitation attempts.
Back to solutions
Discuss your use case
Web Application Security
Technology solutionWeb Application Firewall
Inspect web requests before they reach the application and enforce rules for injection and XSS with testable exceptions.
What is this solution?
A WAF operates at the application layer on HTTP and HTTPS traffic routed through inspection. It parses paths, headers, parameters, or bodies where supported and applies rules to allow, log, or block. Unlike a network firewall, it reasons about application requests; it does not replace fixing application vulnerabilities or authorization logic.
A web application firewall performs HTTP request inspection. WAF virtual patching can reduce exposure while the underlying application is fixed.
Practical example
A public web form receives unusual requests. The team checks the rule against legitimate and suspicious traffic before enabling blocking.
Technical summary and scope of use
Technical explanation
These capabilities describe this layer within the integrated protection architecture. Availability depends on the licensed components and integrations.
Scope of use
Review the HTTP path, where TLS terminates, and the impact on legitimate requests. Gateway protection does not replace application fixes.
What it delivers
Core capabilities that turn the requirement into practical controls.
Web application protection
Connection and protocol management
Session and identity protection
Expected value
The impact security teams and leadership can expect from the right implementation.
Lower exploitation risk
Better application-layer visibility
Faster protection before code remediation
Technical capabilities
Feature availability depends on product version, target systems, deployment, and integrations.
Web application protection
Check each HTTP(S) request before it passes to the application
Inspect a sample in the supported scope and compare the signals with both normal and unusual activity.
Negative protection models through banned lists to detect known attacks such as injection and XSS
Inspect input for known attack patterns; inspection does not replace fixing the application.
Smart discovery patterns target families with complete attacks and not just single flaws
Combine relevant detection signals and review blocking impact on legitimate traffic before production.
Protocol and request normalization to prevent filter bypass
Normalize HTTP requests before rule evaluation so differences in encoding or parsing do not bypass inspection.
Positive security model: deny requests unless explicitly allowed
Test the scenario that triggers protection and a similar legitimate case to tune false positives.
Detection of deviations from normal behavior using anomaly detection
Correlate activity with its context to surface anomalies for review without treating every deviation as an incident.
Discover bots and browsing programs that try to appear as ordinary users
Distinguish suspicious automation from normal traffic and test exceptions for legitimate integrations.
Protection from DoS on Seventh Class
Gateway controls limit abusive requests within available capacity; volumetric floods may need upstream protection.
Protection against bots and automatic attacks
Distinguish suspicious automation from normal traffic and test exceptions for legitimate integrations.
Threat Intelligence, Webroot Feed Integration and GEO Filters
Combine relevant detection signals and review blocking impact on legitimate traffic before production.
Connection and protocol management
HTTP(S) reverse proxy
Receive connections in front of the service, then apply policy before forwarding requests.
TLS termination
Terminate TLS at the gateway for inspection and define how the connection to the application is protected.
OCSP and OCSP stapling
Check certificate revocation status and validate connection behavior when status lookup is unavailable.
Support to Encrypt
Integrate certificate enrollment or renewal with a compatible issuer; test authorization, renewal, and revocation.
Integrated with HSM
Integrate key operations with hardware protection where supported and review key export restrictions.
Service virtualization and content rewriting
Expose or rewrite service paths or content and verify that expected application behavior is preserved.
ICAP interface high availability
Send covered content to an external inspection service and define gateway behavior if the service is unavailable.
Session and identity protection
Cookie protection
Identify which cookies are protected and test application behavior when their values change or the session expires.
CSRF tokens
Verify session-bound proof before accepting state-changing requests, as appropriate to the application.
URL encryption
Identify the URL elements covered by the feature and test saved links and redirects.
form protection
Verify which form fields and values protection rules allow before forwarding the request.
Dynamic Value Endorsement
Associate users or groups with authorized scope and review how membership changes affect access.
Upstream authentication
Authenticate users before forwarding requests to the integrated application and test rejection of gateway bypass paths.
Access control when integrated with the identity system
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Single Sign-On
Associate users or groups with authorized scope and review how membership changes affect access.
Enforcement Point for Access Rules
Turn organizational requirements into testable settings and define who may approve exceptions.
Secure session management
Set session lifetime and termination conditions, and test rejection after expiry.
JWT and Connecting JWKS servers
Verify token signature, issuer, audience, and expiry before accepting the request.
Supports OAuth 2.0, OpenID Connect 1.0 and SAML 2.0 when integrated with the ID system
Federate sign-in through an identity provider; validate token issuer, audience, and expiry.
Identity propagation of old systems that do not support modern standards
Associate users or groups with authorized scope and review how membership changes affect access.
Integration and Monitoring
Integration with SIEM.
Send structured events to monitoring and verify that key fields arrive with the event time and asset context.
Integrated with viral scans.
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Integration with fraud prevention systems.
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Integrated with HSM
Integrate key operations with hardware protection where supported and review key export restrictions.
Integrate records with Splunk, Logpoint, ArcSight and others
Send structured events to monitoring and verify that key fields arrive with the event time and asset context.
Organized records in JSON format
Record what happened, when, and in which scope; review event fields and retention for investigation and audit.
Common Event Format (CEF) support
Send structured events to monitoring and verify that key fields arrive with the event time and asset context.
Lucene query syntax
Show activity within the covered scope and associate events with an asset or session during review.
Access statistics
Show activity within the covered scope and associate events with an asset or session during review.
Places ready for safety, performance and failure detection
Present reviewable results to compare changes and identify cases requiring action.
Custom visualizations
Show activity within the covered scope and associate events with an asset or session during review.
Availability and Continuity
High availability through failover cluster with active-passive and active-active
Reduce disruption from a component failure; test actual failover and recovery to normal operation.
Load balancing
Distribute traffic across endpoints; verify session behavior and removal of unhealthy targets.
health checks
Detect an unhealthy target so traffic is withheld until it is ready again.
Operations and Cloud Infrastructure
Deployment as a virtual appliance or cloud image
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Operating support as a cloud image compatible with AWS, Google Cloud and Azure
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Operating support in Alibaba Cloud
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Configuration management
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Automatic rule suggestions / policy learning
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Staging support
Test rules against representative traffic before production and define rollback if unintended impact appears.
Automation via REST API
Connect defined actions or data to other systems; review authorization, authentication, and failure handling.
What to validate before rollout
- Evaluate incoming request characteristics against the protection rules.
- Test rules before enforcing them to limit disruption to legitimate use.
- Relate alerts to request paths to decide what needs tuning or an application fix.
Integration and scope
Review the HTTP path, where TLS terminates, and the impact on legitimate requests. Gateway protection does not replace application fixes.
Regulatory alignment
Illustrative ways to support control implementation. An area may have more than one example; each row is not necessarily a separate official control.
NCA · ECC 2:2024For entities within the scope of the Essential Cybersecurity Controls.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Network Security Management | Use a reverse proxy to inspect traffic, restrict protocols, and mitigate denial-of-service attacks. Related capability: HTTP(S) reverse proxy, verification of protocols, protection from DoS attacks | Applied |
| Identity and access management | Support access control, standard entry registration, and secure sessions management when integrated with the identity system Related capability: Single Sign-On, Access Control, Safe Sessions Management | Applied |
| Events records and monitoring | Provide organized records, access statistics, tracking panels, and link to monitoring and analysis systems Related capability: JSON records, tracking panels, SIEM integration, Common Event Format | Applied |
| Incident and threat management | Supports detection of threats, malicious behaviors and analysis of suspicious activities Related capability: Threat Intelligence, Detection of Bots, GEO Filters | Applied |
| Management of deficiencies | Supports reducing the exploitation of fractions by applying front protection policies before applying modifications Related capability: Virtual patching | Applied |
| Cryptography | Support communication encryption, certificate verification and integration with key management units Related capability: TLS; OCSP; HSM integration; URL encryption | Applied |
| Protection of data and information | Reduce attempts to manipulate or steal data by protecting forms, cookies and sessions Related capability: form protection; cookie protection; CSRF tokens | Applied |
| Cyber flexibility and continuity of business | Supports high availability, burden balance, and backup failure mechanisms Test failure and recovery paths. This capability does not replace a complete continuity or recovery plan. Related capability: High availability; failover; load balancing; health checks | Applied |
| Cyber Security for Cloud Computing and Hosting | Support publishing as a default device or cloud image within cloud environments Related capability: virtual appliance, cloud image, support as a cloud image compatible with AWS, Google Cloud and Azure as well as Alibaba Cloud | Applied |
SAMA · CSFFor financial institutions within the Saudi Central Bank framework, subject to the control's applicability.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Security Governance | Helps enforce centralized access policies for sensitive accounts, clarify accountability, and support adherence to security policy Settings or logs can help prepare evidence. Governance decisions and effectiveness testing remain with the organization. Related capability: Central Management of Security Policy | Applied |
| Identity and access management | Controls access to sensitive systems according to the principle of the need for knowledge and the need for use. Related capability: Identity management, access and accurate control of powers | Applied |
| Management of Privileges and Powers | Supports restricting the use of high-prioritarian accounts and monitoring their use Related capability: Privileged account management | Applied |
| Access from distance. | Supports administrative access regulation and sensitive accounts-related sessions monitoring Related capability: Access Control and Session Monitoring | Applied |
| Multi-factor authentication | Supports strengthening the identity verification of sensitive accounts and reduces the risks of unauthorized access Related capability: Multi-factor authentication | Applied |
| Management of assets | It contributes to the protection of access to servers, applications, databases and hardware connected with the technology infrastructure Related capability: Management of access to devices, servers, applications and database | Applied |
| Risk Management | Reduce the risk of abuse of privileges, joint accounts and uncontrolled administrative accounts Settings or logs can help prepare evidence. Governance decisions and effectiveness testing remain with the organization. Related capability: Control of sensitive accounts and limiting privileges | Applied |
| Security Monitoring | Provides continuous monitoring of the management activities and user behavior within sensitive systems Related capability: Monitoring user behavior and administrative activities | Applied |
| Events and records. | Supports registration of activities and sessions related to high authority accounts Related capability: Activity logging and audit records | Applied |
| compliance and audit | Provide inspection records that help to review and verify compliance with security policies and procedures Settings or logs can help prepare evidence. Governance decisions and effectiveness testing remain with the organization. Related capability: Audit records and recording sessions | Applied |
| Protection of data | Contribute to the protection of credentials and passwords related to administrative and sensitive accounts Related capability: Protecting Sensitive Data | Applied |
| Protecting the systems | Prohibits unauthorized access to sensitive systems and restricts the execution of unauthorized orders Related capability: Prevent unauthorized access and preventing the execution of unauthorized orders | Applied |
| Protection of Infrastructure | Supports access management to sensitive infrastructure components in local, cloud and hybrid environments Related capability: Unified Management of Systems, Applications and Devices | Applied |
| Operational Security | Reduce the dependence on manual processes through account management and policy implementation Related capability: Automated Account Management and Security Processes | Applied |
| Incident response | Provides records and activities of analytical sessions to support investigations and analysis of events after incidents Related capability: Registration of Sessions and Audit Records | Applied |
| Continuity of business | Reduce the risk of interruption or disruption of processes resulting from abuse of critical accounts Test failure and recovery paths. This capability does not replace a complete continuity or recovery plan. Related capability: Central Management for Access to Sensitive Accounts | Applied |
| Security of third parties | Supports control and monitoring of access to sensitive systems by external users or related entities Related capability: Access Control and Session Monitoring | Applied |
| Security of cloud environments | Supports access management through cloud, local and hybrid environments Related capability: Supporting cloud, local and hybrid environments | Applied |
| Protection of sensitive financial systems | Limit access to highly sensitive systems and applies monitoring and audit to related administrative accounts Related capability: Management of sensitive accounts and monitoring of sessions | Applied |
| Protection of Critical Environments | Supports the protection of administrative accounts used in critical systems by limiting authorities and registrating activities Related capability: Protection of administrative and sensitive accounts | Applied |
NCA · OTCC-1:2022For operational technology and industrial control environments to which the controls apply.
Evaluate these examples against the facility level and assets in scope. They do not authorize IT/OT connectivity or component installation on operational assets without assessment.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Visibility and monitoring | Provide organized records, tracking panels, access statistics, and link to monitoring and analysis systems Related capability: logging; dashboards; SIEM integration | Applied |
| Isolation of networks. | It can be used as a front intermediate between users and services. Use only authorized paths and assets. Network isolation and remote-access approval requirements still apply. Related capability: reverse proxy | Applied |
| Communication between IT and OT | It can be used as a port for applications and software interfaces between different regions with the imposition of access controls Use only authorized paths and assets. Network isolation and remote-access approval requirements still apply. Related capability: HTTP(S) reverse proxy; access enforcement | Applied |
| Access control | Supports access control, standard login registration, and verification of characteristics when integrated Use only authorized paths and assets. Network isolation and remote-access approval requirements still apply. Related capability: access control; Single Sign-On; JWT; JWKS | Applied |
| Discover threats. | Supports behavioral analysis, detection of bots and exploitation of threat information Related capability: threat intelligence; anomaly detection; bot detection | Applied |
| Incident response | Supports the collection and connection of records and events with security analysis and monitoring systems Verify asset compatibility and test operational impact before deploying an agent or taking response action in an OT environment. Related capability: structured logs; SIEM; Common Event Format | Applied |
| Protection of remote access | Supports secure sessions management and access control at application level Use only authorized paths and assets. Network isolation and remote-access approval requirements still apply. Related capability: secure session management; access control | Applied |
Aramco · SACS-210 (2026)For Aramco third parties, subject to their classification and assessment scope. These examples do not establish CCC certification.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| WAF inspection of internet-facing application traffic | A WAF can inspect HTTP and HTTPS for external applications when traffic is routed through it and HTTPS inspection is configured. Direct access to the origin can bypass that inspection. | Applied |
“Applied” describes the capability in the illustrative example, not an implementation or compliance status for the customer.
Decision questions
Questions before you start
How do we know this solution is right for us?
Start with the risk signals on this page. If they match your environment, they can be turned into a short assessment that defines scope, priority, and a practical implementation approach.
How do we start without adding operational complexity?
Start with a focused risk and scope assessment, then define implementation priorities, technical requirements, and phased rollout steps.
Related solutions
CIAM
Customer Identity and Access Management
Govern how customers, partners, and external users access digital services.
Explore solutionWAAP
Web Application and API Protection
Extend application protection to APIs, bots, and abuse scenarios.
Explore solutionAPI Security
API Security Gateway
Govern API protection through validation, authorization, usage monitoring, and exposure reduction.
Explore solutionReady for the next step?
Turn this need into a practical assessment and clear implementation plan.
Share your use case and priority systems so we can discuss a pilot and its integration requirements.