Web Application Firewall (WAF)

Applies to. 6.4.2 requires an automated technical solution in front of every public-facing web application that continually detects and prevents web-based attacks: actively running, kept up to date, generating audit logs, and configured either to block attacks or to raise an alert that is investigated. The guidance to 6.4.2, and to the 6.4.1 it replaces now that it is in effect, names a web application firewall as the usual way to meet it, while the requirement itself names the outcome rather than the product. The penetration testing methodology under 11.4.1 must separately include application-layer testing for the vulnerabilities in 6.2.4, so a WAF sits alongside secure coding and testing, not in place of them.

Limits. A WAF does not stand in for application-layer penetration testing or secure coding; the standard asks for those separately. As a matter of general practice, a WAF set to detect only does not meet a requirement to prevent.