CORE
WAAP
Next-Level Web & API Security
Core WAAP is a comprehensive security solution that can be integrated into CI/CD pipelines and increases the agility and security of modern IT environments through deep visibility and control and a container-native approach.
CHALLENGE
Modern IT departments are challenged to expand their application scope without increasing staff. While breaking down large, monolithic applications into smaller components and increasing the use of microservices improves functionality and usability, they also increase the application’s attack surface. Because traditional WAFs are located at the edges of clusters, they cannot capture internal traffic between pods („east-west“). Annually, over 85% of organizations experience application-layer attacks that bypass their WAF. This becomes especially critical as applications become more complex and diverse, development cycles become shorter, and migration to the cloud – whether private or public – continues to increase.
SOLUTION
Our Core WAAP is a comprehensive security solution for web applications in CI/CD environments. It enables the integration of WAF rules directly into Kubernetes-orchestrated pipelines, provides detailed visibility down to the pod level and supports effective security measures both locally and in the cloud. Seamless compatibility with common deployment and testing tools meets the requirements for automation, flexibility and resilience. This deep integration promotes effective security measures and supports the implementation of defense-in-depth strategies through identity-based microsegmentation and robust security policies that protect against the most common security threats such as SQL injection and cross-site scripting.
In addition, Core WAAP enables faster deployment through predefined templates, simplifies policy management, and enables the implementation of zero-trust rules for workloads within the cluster. This advanced security solution increases the agility and transparency of application development and deployment through a container-native security approach specifically designed to meet the needs of modern container or cloud-native application landscapes.
HIGHLIGHTS
- Seamlessly protects both cloud and legacy apps and APIs
- Hybrid security model
- OWASP Top 10 Protection (OWASP Core Rule Set)
- Autolearning to reduce and avoid false positive request blocks
- Fast and easy implementation
- easy to integrate into CI/CD processes, Infrastructure as Code
- Virtual patching protects applications from an attack due to a vulnerability that is not yet patched or has not yet been patched
- Resource-saving, scalable
- Various options for extension (native C++, lua script, proxy-wasm, gRPC)
