Wombat

WAF-SEC-140 – Web Application Firewall and DDoS protection MUST be enabled for public endpoints

Pillar: Security | Severity: 🟠 High | Category: Network Security | Automatable: High

Description

All internet-facing applications and APIs MUST be protected by a Web Application Firewall (WAF) with managed rule sets. Distributed Denial-of-Service (DDoS) protection MUST be enabled at the network and application layers. WAF rules MUST block common attack patterns (OWASP Top 10) and be reviewed quarterly. Rate limiting MUST be configured to mitigate abuse and volumetric attacks.

Rationale

Risk Description

Risk

Unprotected public endpoints are directly exposed to SQL injection, XSS, and other OWASP Top 10 attacks.

Risk

Missing DDoS protection allows trivial disruption of services by saturating network or application capacity.

Requirements

  • All internet-facing applications and APIs MUST be protected by a Web Application Firewall (WAF) with managed rule sets.

  • Distributed Denial-of-Service (DDoS) protection MUST be enabled at the network and application layers.

  • WAF rules MUST block common attack patterns (OWASP Top 10) and be reviewed quarterly.

  • Rate limiting MUST be configured to mitigate abuse and volumetric attacks.

Implementation Guidance

  1. Document the requirement in a version-controlled policy, ADR, or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

  3. Implement the required configuration as code in Terraform or equivalent IaC.

Maturity Levels

Level Name Criteria

L1

Ad hoc – control not consistently applied

* Die Anforderung ist nicht einheitlich umgesetzt; Nachweis existiert nur punktuell oder fehlt.

L2

Standardised – policy defined and communicated

* Eine dokumentierte Policy oder ein Standard beschreibt die Anforderung.

L3

Integrated – automated validation in CI/CD

* Terraform-Checks oder IaC-Gates prüfen die Anforderung automatisch in CI/CD.

L4

Auditable – metrics and exceptions tracked

* Abdeckung, Ausnahmen und Qualitätsmetriken werden quartalsweise berichtet.

L5

Optimised – continuous improvement based on data

* Die Effektivität wird kontinuierlich gemessen und automatisch optimiert.

Checks

waf-sec-140.tf.aws.waf-associated

Engine: terraform | Provider: aws | Automated: Yes

AWS public ALB/CloudFront distributions must have an associated WAFv2 WebACL

AWS public ALB/CloudFront distributions must have an associated WAFv2 WebACL

Scope: resource — aws_wafv2_web_acl_association, aws_cloudfront_distribution

Assertions: * web_acl_arn attribute_exists — Public resource must be associated with a WAFv2 WebACL.

Remediation: AWS public ALB/CloudFront distributions must have an associated WAFv2 WebACL

Compliant
# Example compliant with waf-sec-140.tf.aws.waf-associated
Non-Compliant
# Example non-compliant with waf-sec-140.tf.aws.waf-associated

waf-sec-140.tf.azurerm.front-door-waf

Engine: terraform | Provider: azurerm | Automated: Yes

Azure Front Door/CDN must use WAF policy with managed rules

Azure Front Door/CDN must use WAF policy with managed rules

Scope: resource — azurerm_cdn_endpoint_security_policy, azurerm_frontdoor_firewall_policy

Assertions: * managed_rule attribute_exists — WAF policy must include managed rule sets.

Remediation: Azure Front Door/CDN must use WAF policy with managed rules

Compliant
# Example compliant with waf-sec-140.tf.azurerm.front-door-waf
Non-Compliant
# Example non-compliant with waf-sec-140.tf.azurerm.front-door-waf

waf-sec-140.tf.google.cloud-armor

Engine: terraform | Provider: google | Automated: Yes

GCP backend services must be protected by Cloud Armor security policy

GCP backend services must be protected by Cloud Armor security policy

Scope: resource — google_compute_backend_service, google_compute_backend_bucket

Assertions: * security_policy attribute_exists — Backend service must reference a Cloud Armor security policy.

Remediation: GCP backend services must be protected by Cloud Armor security policy

Compliant
# Example compliant with waf-sec-140.tf.google.cloud-armor
Non-Compliant
# Example non-compliant with waf-sec-140.tf.google.cloud-armor

waf-sec-140.config.sovereign-provider-waf-documented

Engine: config | Provider: any | Automated: No

Sovereign provider public endpoints must have WAF/DDoS configuration documented

Sovereign provider public endpoints must have WAF/DDoS configuration documented

Scope: file — docs/security/waf-ddos.md

Assertions: * exists attribute_exists — WAF/DDoS documentation must exist for sovereign provider public endpoints.

Remediation: Sovereign provider public endpoints must have WAF/DDoS configuration documented

Compliant
# Example compliant with waf-sec-140.config.sovereign-provider-waf-documented
Non-Compliant
# Example non-compliant with waf-sec-140.config.sovereign-provider-waf-documented

Evidence

  • Terraform configuration implementing the requirement.

  • Policy, ADR, or standard documenting the requirement.

  • Optional cloud console or API output confirming runtime state.

Related Controls

  • WAF-SEC-040

  • WAF-SEC-050

  • WAF-SEC-080

  • WAF-SEC-160

  • WAF-SEC-010

  • WAF-REL-110

  • WAF-AGN-110 == Regulatory Mapping

  • ISO 27001:2022: A.8.9 – Configuration management, A.8.16 – Monitoring activities, A.8.23 – Web filtering

  • CIS Controls v8: CIS 13 – Network Monitoring and Defense

  • PCI DSS v4.0: Req 1 – Install and maintain network security controls, Req 6.4 – Prevent common vulnerabilities

  • SOC 2 Type II: CC6.6 – Security infrastructure and software, CC7.2 – System monitoring

  • GDPR: Art. 32 – Security of processing

  • NIS2: Art. 21(2)(d) – Network and information security

  • DORA: Art. 9 – Protection and prevention

  • EUCS (ENISA): NS-03 – Network security

  • BSI C5:2020: INF-03 – Network security, INF-04 – Communication security

  • NIST SP 800-53: SC-7 – Boundary Protection, SI-4 – Information System Monitoring

  • NIST CSF 2.0: PR.DS-01 – Data security