[AWS] WAF Managed Rule Set 적용 예

> WAF RuleSet 적용 검토

• 기본 적용 사항
  - Known Bad Input/ Managed Common Ruleset
  

 

RuleSet 적용 권장 사항

• AWS Managed
  • Core Rule Set - OWASP Top 10기반 Core Rule, Count Mode로 운용
    
    

 

 

• SQL Database - SQL Injection, Count Mode로 운용
  
  

 

 

• Known bad inputs - Log4J Issue
  
  

 

> 3rd Party Managed - Option

• F5 Managed - Web Exploit / API Audit

 

• Fortinet - OWASP Detect/ Deny Rule
  
  

 

 

>Manual Rule

• Deny Country - Rule Builder
  
  

 

요구 사항에 맞게 추가 - 예시> Korea, Democratic People's Republic of - KP

 

>Deny IP - IP Set

• Create IP set

 

 

• Add-on IP Set