Why and how you should protect your Web Applications in the cloud
By: John Yoon
Tags: Cdn, Cloudflare, Waf, Azure, AWS

Public Internet is brutal. It is essential to have a Web Application Firewall (WAF) and powerful Content Delivery Network (CDN) capabilities to protect your Web applications and Web sites. But what vendor shall we choose and why?

The average cost of a data breach has risen to $3.92 million. Reports show a 1.6% increase in costs in 2018 and a 12% rise over the last five years. Fines for violating the regulation can range from up to €20 million ($22.5 million) to 4 per cent of a company annual global revenue — whichever is greater.

Top Cases of data breaches

Globally, just under 30% of organizations are likely to suffer at least one breach over the next 24 months. U.S. organizations face the highest costs with an average of $8.19 million per breach, driven by a complex regulatory landscape that can vary from state-to-state, especially when it comes to breach notification. In the UK the figure is slightly lower than the global average, at $3.88 million. The size of the average data breach is now 25,575 records, an increase of 3.9% compared to 2018. The average breach size in the U.S. is higher at 32,434 and slightly lower in the UK at 23,600 (both figures up over 2018). Each record lost costs around $150 on average globally; in the U.S. that figure rises to $242 while in the UK the cost is $155 per record. While the loss of thousands of records at a time is becoming common, Equifax-level breaches involving millions of records are still relatively rare. A “mega-breach” of 1 million records could cost a company $42 million — up from $40 million last year — while the loss of 50 million records might cost a company $388 million.

On the other hand, the prices of Attack services are becoming very low.

Attack services are inexpensive

For example, for $327 per week, bad actors can perform a DDoS attack on your Web application paralysing your business costing you thousands or millions.

Executives start getting these messages. Companies start setting better security practices. The penalties significantly outweigh savings from inaction.

One of the most effective ways to protect your Web applications is to introduce Proactive Defense mechanisms. Proactive Defence infrastructure “predicts” cyberattacks before it happens and mitigates in real-time. Modern cyberattacks are sophisticated and massive. For example, a distributed denial-of-service (DDoS) attack is a malicious attempt to disrupt normal traffic of a targeted service by overwhelming the target with a flood of Internet traffic. A DDoS attack is like a traffic jam clogging up with highway, preventing regular traffic from arriving at its desired destination. Unlike other types of cyberattacks, DDoS attack defence requires extensive infrastructure that can absorb malicious traffic while letting regular traffic through.

A DDoS attack in Layman's terms

Other types of cyberattacks include sending maliciously-formed requests with the expectation to disrupt Business services. Many attack types can be detected in real-time by Web Application Firewalls (WAF). WAF analyses the incoming traffic and automatically blocks undesired communications.

WAF blocks malicious traffic

There are hundreds of Security software and hardware solutions on the market. This post is about modern cloud web applications and therefore, we shall analyse only modern cloud platforms capable to protect from enormous DDoS attacks. We shall go through four major players on the market.

Microsoft Azure

The Microsoft Azure solution has a rich set of functionality that is built from various Azure components. Building and deploying multiple components may bring higher costs and may be prone to errors and misconfigurations. Ongoing support may also require more advanced Security Operations knowledge and skills.

Azure DDoS protection service provides defence against DDoS attacks. There are two options: Basic DDoS that comes at no extra costs, and Standard, a paid option, which can provide better services, access to logs, monitoring, L7 protection via WAF.

Azure DDoS protection

Azure Application Gateway with WAF is a web traffic load balancer that manages Web Applications traffic while providing the centralised protection of web applications from common exploits and vulnerabilities. A centralised WAF helps make security management much simpler and gives better assurance to application administrators against threats or intrusions. A WAF solution can also react to a security threat faster by patching a known vulnerability at a central location versus securing each of individual web applications.

Azure Web Application Firewall

Cloudflare

Cloudflare is one of the world’s largest networks. Cloudflare provides security solutions to businesses, non-profits, bloggers, websites and apps. More than 20 million Internet properties are on Cloudflare. The Cloudflare network is growing by tens of thousands each day. Cloudflare powers Internet requests for ~10% of the Fortune 1,000 for more than 1 billion unique IP addresses per day.

Cloudflare provides security by protecting Internet properties from malicious activities like DDoS attacks, malicious bots, and other nefarious intrusions. Cloudflare has an excellent reputation with the very advanced DDoS protection, WAF, Content Delivery Network (CDN), TLS traffic encryption, automatic certificate management and many other features.

Cloudflare model

Cloudflare administration includes a common control plane over multiple well-integrated services. The configuration can be done via an intuitive, secure Web portal.

Configuring DNS zone in Cloudflare portal

Akamai

Akamai is a very advanced solution in Web Application Security and Content Delivery. The combination of Akamai solutions covers the requirements of the most demanding customers. However, the solution can be an overkill in specific applications. Akamai has a multitude of products. Kona and Ion products can cover the majority of the requirements related to Cybersecurity and Web Performance.

Kona Site Defender provides application security at the Edge — closer to attackers and further from applications. With 178 billion WAF rule triggers a day, Akamai harnesses unmatched visibility into attacks to deliver curated and highly accurate WAF protections that keep up with the latest threats. Flexible protections help secure the entire application footprint and respond to changing business requirements, including APIs and cloud migration, with dramatically lower management overhead. Akamai reported that it successfully protected a customer experiencing the largest (1.3 TBps) DDoS attack.

Akamai Kona Site Defender features

Ion is a suite of intelligent performance optimisations and controls that helps deliver superior web, mobile app experiences. Built on the SLA-backed availability of the globally distributed Akamai Intelligent Edge Platform™, Ion continuously monitors real user behaviour — applying best-practice performance optimisations automatically — and adapting in real-time to content, user behaviour, and connectivity changes.

Akamai Ion

Amazon AWS CloudFront

Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds, all within a developer-friendly environment. CloudFront is integrated with AWS — both physical locations that are directly connected to the AWS global infrastructure, as well as other AWS services. CloudFront works seamlessly with services including AWS Shield for DDoS mitigation, Amazon S3, Elastic Load Balancing or Amazon EC2 as origins for your applications, and Lambda@Edge to run custom code closer to customers’ users and to customize the user experience.

AWS CloudFront logo

Amazon CloudFront is a highly-secure CDN that provides both network and application-level protection. Your traffic and applications benefit through a variety of built-in protections such as AWS Shield Standard, at no additional cost. You can also use configurable features such as AWS Certificate Manager (ACM) to create and manage custom SSL certificates at no extra cost.

CloudFront edge locations map

Conclusion

We have described four major players on the market. It is important to go through a particular system’s requirement to make your choice. We deliberately not including Gartner Magic quadrant charts here. These companies are jumping in the quadrant quite fast. The quadrant also presents some parts of the Security feature set. It is much better to look at the feature set and prices of the services that you want to use.

In my opinion, in general, the Cloudflare solution provides the best combination of well-integrated security services at a very reasonable price. Cloudflare also has entry-level plans, including a free plan for a simple single domain. The solution has a proven history of defending from massive-scale attacks. The Cloudflare solution is capable of absorbing an attack with the traffic that is 15 times higher than the world’s largest registered DDoS attack to date. Cloudflare is relatively easy to implement. It is a solution that works out-of-the-box without extensive engineering efforts. The solution offers a very nice and easy administration Web portal.

John Yoon

Solution Architect