Web Application
Firewall (WAF)
Managed protection for your public-facing web applications and APIs. A Web Application Firewall (WAF) that sits between the internet and your applications, blocking the OWASP Top 10, automated bots and DDoS, with the policy configured, applied and operated by Cloud Gateway.
What is Secure Application Access?
Secure Application Access is Cloud Gateway’s managed Web Application Firewall (WAF): a sophisticated, configurable firewall that protects your web applications and APIs from malicious traffic. It sits between external users and your applications, inspecting inbound HTTP and HTTPS traffic and blocking attacks before they reach what you’re protecting, while letting legitimate traffic through.
Where Managed Firewall protects traffic at the network layer, and Secure Internet Access protects your users as they reach out to the internet, Secure Application Access protects the applications you expose to the world. It’s the inbound counterpart: the defence for the websites, portals and APIs your business, your customers and your users depend on.
The rules are defined by you. Cloud Gateway designs the configuration, applies the security policy and manages it on your behalf, so the protection is actively maintained rather than left to you to tune.
For an explanation of how a WAF works as a technology, you can find our WAF and application security guide in the Knowledge Centre. This page covers what Cloud Gateway delivers.
Benefits of Secure Application Access
Your public-facing web applications and APIs defended against the OWASP Top 10, injection and scripting attacks, bots and DDoS, before malicious traffic reaches them.
You define the rules; Cloud Gateway designs the configuration, applies the policy and manages it throughout the contract, so you’re not left tuning a WAF yourself.
Cost is based on throughput rather than the number of sites or domains, so you can protect multiple applications under one service without per-site charges.
Traditional detection engines block known attacks, and a machine-learning engine examines what passes the first layer against a continuously updated model of your applications, reducing both missed threats and false positives.
Positive security model policies generated from your schema (OpenAPI, XML, JSON) protect against API exploits, and can be integrated into your CI/CD pipeline so the policy updates as your API does.
Cloud Gateway monitors the service 24/7, on UK data centres and UK network infrastructure, with logging that can integrate into your SIEM or SOC on request.
What's included
You work with Cloud Gateway to define the protections you need. We design, install and configure the WAF, provide the inbound connectivity to the platform that the service needs, manage the policy throughout the contract, give you access to the Cloud Gateway Portal, and monitor the service around the clock.
The service provides a comprehensive application-protection capability set, which typically includes:
- Web application security against the OWASP Top 10 and a wide range of other threats, including cross-site scripting, SQL injection, buffer overflows, file inclusion, cookie and schema poisoning, using attack signatures, IP reputation and protocol validation, backed by a machine-learning detection engine.
- API protection through out-of-the-box policies and an automatically generated positive security model based on your schema.
- Bot mitigation against scrapers, crawlers, data harvesting and credential stuffing, combining machine learning with techniques including threshold detection, bot deception and CAPTCHA challenges, while reducing friction for legitimate users.
- A built-in vulnerability scanner, Layer 7 load balancing and content-based routing, HTTPS/SSL offloading with certificate authentication support, and network and application-layer DoS/DDoS protection.
Secure Application Access is a WAF service and is delivered as a component of the platform. It’s not a SOC or SIEM, though its logging can integrate with your SIEM or SOC on request. Managed Firewall and Secure Internet Access are separate components that protect different parts of the estate.
Our case studies
Organisations
we’ve helped
How Secure Application Access is delivered
01. Step one
First, we work with you to define the protections and policy for your applications and APIs; where requirements are complex, we’ll meet to work through the granular configuration options.
02. Step two
We design, install and configure the WAF and provide the inbound connectivity to the platform. Lead time depends on the scope and complexity of the configuration, we’ll give a timeline with the full proposal.
03. Step three
Third, we confirm you can reach the application destinations in your policy and that logs are being generated. The solution is fully tested by us, and by you, before go-live.
04. Step four
Fourth, the service is monitored around the clock, with policy managed throughout the contract and events visible in the Cloud Gateway Portal.
Common questions about Secure Application Access
What is a Web Application Firewall (WAF)?
A WAF monitors and filters the HTTP and HTTPS traffic between the internet and a web application, blocking web-based attacks such as SQL injection and cross-site scripting while letting legitimate traffic through. Cloud Gateway’s Secure Application Access is a managed WAF: we configure and operate it for you rather than handing you a console to tun
What's the difference between a WAF and a network firewall?
A network firewall protects at the network layer (Layers 3 and 4), controlling traffic across the network broadly. A WAF works at the application layer (Layer 7), protecting web applications from web-specific attacks. They’re complementary: Cloud Gateway’s Managed Firewall covers the network layer, Secure Application Access covers public-facing applications.
Does a WAF protect against DDoS?
Yes. The service includes network and application-layer DoS/DDoS protection, using techniques such as rate limiting and pattern recognition to mitigate the risk of applications being overwhelmed by malicious traffic.
Does it protect APIs as well as websites?
Yes. API protection is built in, using out-of-the-box policies and a positive security model generated from your schema (OpenAPI, XML or JSON). Schema validation can be integrated into your CI/CD pipeline so the policy updates automatically when your API changes.
How is Secure Application Access priced?
Cost is calculated on bandwidth rather than the number of sites or domains, so you can protect multiple applications under one service without per-site charges. It’s usually quoted as part of a wider platform proposal.
What's the difference between this and Secure Internet Access?
Secure Internet Access protects your users as they reach outbound to the internet and SaaS. Secure Application Access protects your public-facing applications from inbound attacks. They solve opposite halves of the traffic picture. For how security fits across the platform, see Protect.
