Web Application Firewall (WAF)
散页
Keysight CyPerf pioneered the agent-based network application and security test solution category, meticulously recreating realistic workloads across diverse physical and cloud environments to deliver unparalleled insights into end user quality of experience (QoE), security posture, and performance bottlenecks of distributed networks. Our CyPerf WAF test offering helps validate a WAF’s ability to block attacks, such as OWASP attacks, while allowing legitimate traffic to pass through uninterrupted.
Challenges in Understanding WAF Performance, Deployment, and Security Efficacy
• Getting consistent performance and security from a WAF irrespective of the platform it is deployed on
• Understanding the variation in performance benchmarks that results from WAFs being deployed in different modes like transparent or reverse proxy
• Securing highly complex websites / client browser technologies against a wide variety of threats
• Finding the balance between quality of experience (QoE) and security because enabling many security features impacts performance
• Testing scalability of WAF security rules as a poorly written security rule / regexp can cause performance bottlenecks or crashes when accessed by a large number of clients
CyPerf—Your Solution to Developing High-Performing WAFs
• Leverage HTTP and TLS feature support to benchmark both HTTP and TLS performance of WAFs
• Measure WAF performance in handling popular website types like social media, e-commerce, banking, and video streaming • Generate OWASP Top 10 attacks like injections, cross site scripting and also non OWASP attacks like file inclusion, and authentication bypass
• Test hybrid, proxied WAF deployments using distributed CyPerf test agents exchanging application and attack traffic between on-premises and cloud platforms
• Simplify complex test requirements by simulating client types like Firefox, Safari, Chrome, iOS, and Android and server technologies like JS, CSS3, HTML5, and PHP
• Generate both application and attack traffic to accurately evaluate the performance cost of security features strike a right balance with QoE