Radware AppWall

What is Radware AppWall?

Radware AppWall is a Web Application Firewall (WAF) with a unique positive security model - instead of blocking known attacks (blacklist), AppWall learns normal application behavior and blocks everything that is an anomaly.

Main functions:

• Positive Security - whitelist instead of signatures
• Auto-Policy - automatic policy generation
• API Security - REST/GraphQL/SOAP protection
• Bot Protection - malicious bots and scrapers

What problem does it solve?

flowchart LR
    subgraph Traditional WAF
        A[Signature-based] --> B[Known attacks]
        B --> C[Zero-day = bypass]
        C --> D[False positives]
    end

    subgraph AppWall
        E[Positive Security] --> F[Learns application]
        F --> G[Blocks anomalies]
        G --> H[Zero-day protected]
    end

    style A fill:#dc2626,stroke:#b91c1c,color:#fff
    style B fill:#dc2626,stroke:#b91c1c,color:#fff
    style C fill:#dc2626,stroke:#b91c1c,color:#fff
    style D fill:#dc2626,stroke:#b91c1c,color:#fff
    style E fill:#22c55e,stroke:#16a34a,color:#fff
    style F fill:#22c55e,stroke:#16a34a,color:#fff
    style G fill:#22c55e,stroke:#16a34a,color:#fff
    style H fill:#22c55e,stroke:#16a34a,color:#fff

Typical problems:

• SQLi, XSS, injection attacks on applications
• APIs without protection - new attack vector
• Bots performing credential stuffing and scraping
• Traditional WAF = too many false positives
• Zero-day attacks bypass signatures

How does AppWall work?

flowchart TD
    A[Request] --> B[AppWall]
    B --> C{Learning Mode?}
    C -->|Yes| D[Build baseline]
    C -->|No| E{Positive Security Check}
    E --> F[Signature Check]
    F --> G{Allowed?}
    G -->|Yes| H[Pass to App]
    G -->|No| I[Block/Challenge]

    D --> J[Auto-generate Policy]
    J --> E

    style A fill:#6366f1,stroke:#4f46e5,color:#fff
    style B fill:#f59e0b,stroke:#d97706,color:#fff
    style E fill:#8b5cf6,stroke:#7c3aed,color:#fff
    style H fill:#22c55e,stroke:#16a34a,color:#fff
    style I fill:#dc2626,stroke:#b91c1c,color:#fff

Positive vs Negative Security

Aspect	Negative (Traditional)	Positive (AppWall)
Approach	Block known bad	Allow known good
Signatures	Required, constant updates	Optional, supplementary
Zero-day	Vulnerable	Protected
False positives	High	Low (after learning)
Maintenance	Signature updates	Policy refinement
Learning	None	Automatic

Key Features

API Security

Protection for modern API-first applications:

flowchart LR
    A[API Request] --> B[AppWall]
    B --> C[Schema Validation]
    C --> D[JWT Check]
    D --> E[Rate Limiting]
    E --> F[Content Inspection]
    F --> G{Valid?}
    G -->|Yes| H[Backend API]
    G -->|No| I[Block + Alert]

    style A fill:#6366f1,stroke:#4f46e5,color:#fff
    style B fill:#f59e0b,stroke:#d97706,color:#fff
    style C fill:#8b5cf6,stroke:#7c3aed,color:#fff
    style D fill:#8b5cf6,stroke:#7c3aed,color:#fff
    style H fill:#22c55e,stroke:#16a34a,color:#fff
    style I fill:#dc2626,stroke:#b91c1c,color:#fff

Function	Description
OpenAPI Import	Automatic API specification import
Schema Enforcement	Parameter validation vs schema
Method Restriction	Only allowed HTTP methods
Rate Limiting	Per endpoint, per user, per IP
JWT Validation	Token verification

Deployment Options

For whom?

AppWall vs Competition

Aspect	AppWall	F5 ASM	Imperva	AWS WAF
Security model	Positive + Negative	Negative + Positive	Negative	Negative
Auto-policy	Yes	Limited	Limited	None
API Security	Native	Add-on	Native	Basic
Bot management	Integrated	Separate	Integrated	Basic
Learning	Automatic	Manual	Automatic	None
Deployment	HW/VM/Container/Cloud	HW/VM/Cloud	Cloud/VM	Cloud-only

AppWall advantage:

• True positive security model
• Best auto-policy generation
• Integrated bot management
• API-first design
• Low false positive rate

Specifications

Parameter	Value
Throughput	1 Gbps - 40 Gbps
Latency	< 1 ms
Deployment	Hardware, Virtual, Container, Cloud
Protocols	HTTP/HTTPS, WebSocket, HTTP/2
API	REST, GraphQL, SOAP, gRPC
Management	APSolute Vision
Compliance	PCI DSS, OWASP, GDPR

FAQ

What is positive security model? Instead of a list of known attacks (signatures), AppWall learns normal application behavior and blocks everything that deviates from the norm.

How long does learning take? Typically 1-2 weeks for full baseline. Can be accelerated by importing OpenAPI spec.

Can I use signatures? Yes. AppWall combines positive security with negative (signatures) for defense in depth.

How does it protect APIs? OpenAPI/Swagger import, schema validation, rate limiting per endpoint, JWT validation, bot protection.

What about microservices? AppWall as sidecar in Kubernetes or as central API gateway with protection.

Does nFlo deploy AppWall? Yes. On-prem and cloud deployments, auto-policy configuration, CI/CD integration, API security setup.