Bridge WAF
WAAP vs WAF: one filter, or four defences sold together
WAAP stands for web application and API protection. It is a market term for a bundle: a web application firewall plus protection for APIs, bot management and defence against denial of service, usually delivered as a cloud service. The question is not which name is better but which of the four parts you actually need, and whether each part is really there.
Quick facts
- WAAP
- Web application and API protection: a bundle of defences
- Usual parts
- WAF, API protection, bot management, DDoS defence
- WAF alone
- Inspects requests against rules before they reach the application; see OWASP
- What the name does not guarantee
- That every part is equally capable, or that it fits your traffic
- Better question
- Which of the four problems do you have, and what covers each?
What a WAF is, on its own, is on what is a web application firewall.
WAF vs WAAP compared
| Capability | WAF | WAAP bundle |
|---|---|---|
| Request filtering against attack patterns | Yes, the core | Yes, the WAF part |
| API protection | Partly: injection in API calls | Adds schema checks, API discovery, per-key limits |
| Bot management | Little beyond rate limits | Adds classification and responses to automation |
| DDoS defence | Layer 7 floods through limits | Adds network-layer capacity in front |
| Delivery | Cloud, appliance or host | Usually cloud |
A WAAP is not a better WAF; it is a WAF with neighbours. Each neighbour solves a different problem and should be judged on its own.
The API part
APIs fail mostly through authorisation and resource use, as the OWASP API Security Top 10 shows. A WAF sees injection in API calls; WAAP products add knowledge of the API itself, such as which endpoints exist and what a valid request looks like.
Neither can decide whether a caller may read a particular object; that stays in the code. The full picture is on API security.
The bot and DDoS parts
Bot management decides which automated traffic to allow, slow or refuse. It is a different problem from attack patterns, because most bots send perfectly valid requests; see bad bots.
DDoS defence at the network layer needs capacity upstream of your link, which only a network can provide. A request filter covers application floods; floods that fill the link are stopped before requests exist; see DDoS protection.
Where the term WAAP comes from
WAAP is an industry category name, introduced to describe cloud services that had grown beyond request filtering. It does not come with a standard or a test that a product has to pass, so two products called WAAP can differ widely in what each part does.
That is why the useful comparison is part by part. A product with a strong WAF and a thin bot part is a different purchase from one built the other way round, even under the same name.
Questions to ask about any WAAP
- Which of the four parts are included, and which are extra cost?
- How does each part let you observe before enforcing? Every part can refuse real customers.
- What does the API part need from you? A description of the API, or traffic to learn from.
- How are bots classified, and what happens to the ones you depend on, such as search crawlers?
- Where does DDoS capacity sit, and is it always on?
Questions
What is WAAP?
WAAP, web application and API protection, is a market term for a bundle of a web application firewall, API protection, bot management and DDoS defence, usually delivered as a cloud service.
What is the difference between a WAF and WAAP?
A WAF filters requests against attack patterns. A WAAP bundles a WAF with API protection, bot management and network-layer DDoS defence.
Do I need WAAP or a WAF?
It depends on which problems you have. Map your risks to injection, API abuse, automation and floods, then check what covers each, whatever the product is called.