Case study · Manufacturing
Around 120 applications under WAAP, API and bot protection
I led the deployment of Imperva web application, API and advanced bot protection across around 120 applications for a global apparel group headquartered in Sri Lanka.
A global apparel group headquartered in Sri Lanka
- Imperva
- Edge & WAAP
- API security
The setup
The architecture, simplified.
- A global apparel group headquartered in Sri Lanka, with around 120 applications to protect.
- Platform: Imperva WAAP, API Security and Advanced Bot Protection.
- Delivered by Innov8’s Application Security BU, which I head. Scope ran from policy design to handover.
The challenge
What made this hard.
- Many applications, many ownersA multinational group runs applications across business units, each with its own owners, traffic and change windows.
- APIs behind the websitesApplications listed as websites often front APIs that also serve mobile apps and partner systems.
- Good bots and bad botsBot rules had to stop abuse without blocking uptime monitoring, search crawlers, partner integrations or test tools.
- A platform the team can runProtection only lasts if someone can tune it after go-live, so operational handover was part of the scope.
The approach
How the work ran, step by step.
- 01
WAAP policy design
Baseline policies designed per application type, so one approach covers the estate, with documented exceptions where traffic needs them.
- Baseline policy per application type
- Every exception recorded with a reason
- 02
Onboarding in monitoring
Applications onboarded in monitoring mode, so real traffic was reviewed and tuned before anything was blocked.
- DNS and certificates per application
- Origins restricted to WAAP traffic
- False positives tuned before blocking
- 03
API discovery and protection
Endpoints discovered from live traffic and compared with what development teams believed they had published.
- Discovered versus documented endpoints
- Protection applied to key APIs
- 04
Bot protection on key flows
Advanced Bot Protection attached to login, registration and form flows, starting in monitoring, with wanted automation kept allowed.
- Wanted automation listed and allowed
- Native mobile traffic handled separately
- 05
Operational handover
Runbooks, tuning practice and ownership handed to the people who operate the platform day to day.
- Exception and tuning process
- Runbooks and named owners
The outcome
What changed.
Real numbers only where they exist. Everything else is stated plainly, without invented percentages.
- ~120Applications protectedWeb application, API and advanced bot protection deployed across around 120 applications.
- 230+Onboarded to WAAP across two programmesTogether with the 112-application bank migration, more than 230 applications onboarded to WAAP.
- APIs found, not assumedAPI discovery and protection in place, so the inventory reflects endpoints that actually receive traffic.
- Handed over to operateOperational handover completed, with tuning and exceptions owned after go-live.
Lessons
What I would tell the next team.
- Lesson 01
Same lessons, different platform
Imperva here, F5 at a bank: inventory, origin lockdown and monitoring before blocking decided both. I treat the method as platform-neutral.
- Lesson 02
Attach bot rules to business flows
Protect login, registration and forms, not individual paths. Start in monitoring and list the automation you want to keep before blocking anything.
- Lesson 03
Plan the handover from day one
A WAAP nobody can tune tends to drift back to monitoring or get switched off. Ownership, runbooks and an exception process belong in scope.
Related
Where this experience shows up in my work.
- Service · 2–4 weeksWAAP & API protection assessmentI review your WAF, WAAP, bot and API controls against your real estate and traffic, then show the gaps, the bypass paths and a safe route to blocking.
- Service · 1–3 weeksApplication architecture reviewI take one application or platform and trace every path from the internet to its data, then show which controls hold, which are missing and what to fix first.
What does advanced bot protection add to a WAF?
A web application firewall (WAF) inspects requests for attack patterns. Advanced bot protection looks at behaviour across sessions to separate automated clients from people, which matters on login, registration and form flows where each request looks valid on its own. Here it was deployed alongside the WAF and application programming interface (API) protection, with wanted automation such as uptime monitoring and search crawlers kept allowed.
Why run API discovery during a WAAP deployment?
Many applications listed as websites are front ends to application programming interfaces (APIs) that also serve mobile apps and partners. A web application and API protection (WAAP) platform can discover endpoints from live traffic, which often turns up more than the documented list. Comparing the two shows where the inventory is wrong, and undocumented endpoints are often where unprotected risk sits.
Is this approach specific to Imperva?
No. I used Imperva here and F5 Distributed Cloud for a leading Sri Lankan private bank, and the same things decided both outcomes: a complete inventory, origins locked to the protection layer, monitoring before blocking and a clear operational handover. When I assess an organisation’s edge and application protection, I start from those questions, whatever platform is in place.
More case studies
- 112applications migrated112 bank applications moved to cloud WAAP, wave by waveBanking · A leading Sri Lankan private bankF5 Distributed CloudRead the case
- T1bank vulnerability programmeTier-1 bank scanning upgraded and extended to web applicationsBanking · A Tier-1 Sri Lankan commercial bankTenable Security CenterRead the case
- RASPin-app protection liveIn-app runtime protection live in a customer banking appBanking · A leading private bank’s mobile appZimperiumRead the case
- SIEMtelemetry pipelineWAAP security events arriving in the bank’s SIEM, reliablyBanking · A leading Sri Lankan private bankF5 → Logstash → Trellix SIEMRead the case