Yandex Cloud Smart Web Security

Main article: Firewall

2024: Web Application Firewall Launch

Yandex Cloud launched firewall attacks Firewall Smart Web Security to protect web applications from external Web applications. The company announced this on May 15, 2024. WAF automatically blocks malicious attempts to use vulnerabilities web resources, including those included in the international ranking of the main security threats of OWASP TOP-10 applications. Firewall is native integrated cloudy to the client infrastructure. This will improve the stability and security of sites and applications without complex settings and long-term system deployment. In test mode, WAF will be available for free to all users on demand.

The WAF firewall protects client web applications from malicious attempts to disable their infrastructure and gain unauthorized access to confidential information and databases. It protects web applications from SQL injection, cross-site scripting (xss), remote code execution (RCE), query spoofing (CSRF), and other threats.

Web applications have already become one of the key goals of cyber fraudsters - according to Verizon estimates, 80% of incidents are associated with them, and about 60% of data leaks occur due to them. The use of cloud WAF allows the client to reduce the cost of monitoring traffic and significantly reduce the load on the information security team, since the provider itself is responsible for traffic security.

Users will be able to manually edit attack detection rules and adjust WAF sensitivity - the level at which traffic is considered suspicious. The firewall works in conjunction with Antirobot technology: it also blocks some of the malicious traffic and protects the firewall itself from DDoS attacks.

The security of our customers' infrastructure is one of the key development priorities of Yandex Cloud. We regularly expand our portfolio of information security products to protect the infrastructure of users of our services from the largest range of threats. The introduction of a firewall in Smart Web Security is another step towards ensuring comprehensive security of our customers' data and applications, "said Grigory Atrepyev, CPO of the Yandex Cloud cloud platform.

To detect network attacks, WAF uses a method of searching for signatures - code fragments that are contained in already known examples of malicious traffic. At the first stage, the OWASP Core Ruleset rule set is used for this. In the future, Yandex Cloud plans to develop and integrate its own set of rules for detecting network attacks. It is also planned to use its own ML technologies to analyze malicious traffic: they will be able to automatically detect and block new threats by analyzing suspicious user actions on the network. WAF affiliate services also remain available to Yandex Cloud customers.