Expertise 01 · Edge & WAAP
Stop hostile traffic before it reaches your applications
I have onboarded more than 230 applications to WAAP across two programmes. I check what your edge really blocks, what gets around it and how to reach blocking safely.
In short
Edge security is the set of controls between the internet and your applications and APIs (application programming interfaces), usually delivered as WAAP (web application and API protection): a WAF (web application firewall), bot management and DDoS (distributed denial-of-service) protection. I assess it by checking which applications sit behind the edge, whether each one is blocking or only monitoring, how exceptions are scoped, and whether origins can be reached directly.
What I check
- WAF / WAAP coverage of every internet-facing app
- Blocking versus monitor mode, per application
- Exception scope: signature, parameter and path
- Bot controls on login, OTP and sign-up flows
- DDoS readiness and application-layer rate limits
- Origin exposure and stale DNS records
The threats
What this area has to stop.
The attacks I see most often in this area, and what they cost when they land.
Open the attack simulator- Threat 01SQL injection on a login formCrafted input in a form or parameter tries to read or change the database behind it.Customer data read, altered or deletedSee which layer stops it
- Threat 02Credential stuffing on login and OTPBots replay leaked passwords at scale and trigger a one-time password message on every attempt.Account takeover and messaging costsSee which layer stops it
- Threat 03Application-layer floodHigh volumes of valid-looking requests target expensive pages such as search or login.Customer services slow down or go offlineSee which layer stops it
- Threat 04Exploit of a known flawA public exploit hits an unpatched component before the code fix is deployed.Server compromise during the patch gapSee which layer stops it
- Threat 05Origin bypassAn attacker finds the origin’s address in old DNS records and connects around the WAAP.Every edge control skipped at once
- Threat 06Scraping and fake sign-upsScripts scrape content and prices, or create accounts in bulk for later fraud.Data loss and accounts staged for abuse
The defences
How good looks, layer by layer.
- 01DNS, CDN and DDoSAbsorbs volumetric floods and serves traffic close to users, far from your network.Anycast edge, DNS protection, caching
- 02Bot managementSeparates people from scripts on login, OTP, sign-up and other abuse-prone flows.Client signals, behaviour checks, challenges
- 03WAF and API policyBlocks injection and known exploits, and virtual-patches flaws until the code is fixed.Signatures, positive security, rate limits
- 04Origin protectionMakes servers accept traffic only from the edge, so nobody can route around it.IP allow-lists, mutual TLS, secret headers
- 05Application codeValidates input and checks authorisation: the last line when an edge rule misses.Parameterised queries, input validation
Maturity
Where are you on the staircase?
Four levels I use to score this area. Most improvement plans aim one step up within a year.
- L0Exposed
- No WAF, or one covering only a handful of sites
- Origins answer anyone who finds their address
- L1Deployed, not blocking
- WAF in front of key apps, mostly in monitor mode
- Broad exceptions added to make complaints stop
- L2Blocking and tuned
- Critical apps blocking, exceptions scoped per path
- Bot rules on login and OTP; origins locked down
- L3Managed and proven
- Every internet-facing app covered and inventoried
- Policies re-tested after releases; events in the SIEM
Measure it
Four numbers worth tracking.
- KPI 01Apps covered and blockingShare of internet-facing apps behind the edge and in blocking mode. The headline measure.
- KPI 02Open exceptions and their ageEvery exception is a gap. Old, broad ones show tuning debt that nobody is reviewing.
- KPI 03Origins reachable directlyShould be zero. Anything above zero makes the edge optional for an attacker.
- KPI 04Time to virtual patchHow fast an edge rule goes live for a newly exploited flaw while the code fix is pending.
Frameworks I assess against
- OWASP Top 10
- OWASP Automated Threats to Web Applications
Work with me
How I can help with this area.
- WAAP & API protection assessmentI review your WAF, WAAP, bot and API controls against your real estate and traffic, then show the gaps, the bypass paths and a safe route to blocking.2–4 weeksFixed fee
- Application architecture reviewI take one application or platform and trace every path from the internet to its data, then show which controls hold, which are missing and what to fix first.1–3 weeksFixed fee
- WAAP go-live checklistWhat to check before, during and after moving an application behind a cloud WAAP.Free · interactive
Proof from delivery
- 112applications migrated112 bank applications moved to cloud WAAP, wave by waveBanking · A leading Sri Lankan private bankF5 Distributed CloudRead the case
- 120applications protectedAround 120 applications under WAAP, API and bot protectionManufacturing · A global apparel group headquartered in Sri LankaImpervaRead the case
What is WAAP?
WAAP (web application and API protection) is a set of edge controls that protects web applications and APIs (application programming interfaces) from attack. It combines a WAF (web application firewall) with API discovery and protection, bot management and usually DDoS (distributed denial-of-service) mitigation. Most WAAP platforms run from a cloud edge, so traffic is inspected before it reaches your own servers.
Why is a WAF left in monitor mode a risk?
A WAF (web application firewall) in monitor mode logs attacks but blocks none of them. Starting in monitor mode is good practice, because it shows real traffic before you block. The risk is staying there: I often find deployments that never moved to blocking because nobody owned the tuning or set exit criteria. Every application needs a dated plan to block.
How do attackers bypass a WAF?
The most common route is not a clever payload but the origin. If the server behind the WAF (web application firewall) still accepts traffic from anywhere, an attacker who finds its address through old DNS (Domain Name System) records or certificate logs simply connects to it directly. Other bypasses come from broad exceptions, unprotected hostnames and API (application programming interface) endpoints nobody put behind the edge.
Can a WAAP stop bots on login and OTP pages?
Yes, if the platform’s bot management is switched on and configured for those flows. It uses client signals, behaviour and challenges to separate people from scripts. Attach rules to business flows such as login, OTP (one-time password) requests and sign-up, start in monitor mode, and list the automation you want to keep. Native mobile apps usually need an SDK (software development kit) instead.
Which WAAP platforms do you work with?
Ravindu Fernando, a Colombo-based application security consultant, has deployed web application and API (application programming interface) protection on F5 Distributed Cloud for about 112 applications at a leading Sri Lankan private bank, and on Imperva for about 120 applications at a global apparel group. Assessments stay vendor-neutral: coverage, blocking mode, exceptions, origin protection and logging matter on any platform.