Ensure that application-layer traffic from the internet is inspected and filtered before it reaches backend targets.
Attach a Web Application Firewall to Internet-Facing Listeners
CCC.LB.CN11 · Networking
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.Core.CP04 | Transaction Rate Limits | The service can throttle, delay, or reject excess requests when transactions exceed a user-specified rate limit, and always provides industry-standard throughput up to that limit. |
| CCC.LB.CP23 | Web Application Firewall Integration | The service can integrate with a web application firewall so that only legitimate traffic reaches backend servers, blocking malicious requests. |
| CCC.LB.CP03 | Layer 7 Routing | The service can distribute incoming traffic based on application layer (OSI layer 7) information. Some of the supported protocols on layer 7 are HTTP/2, HTTP/3, HTTPS, gRPC, and WebSockets. |
| CCC.LB.CP04 | Layer 4 Routing | The service can distribute incoming traffic based on transport layer (OSI layer 4) information, using the combination of IP addresses and TCP/UDP ports rather than inspecting the content of the packets. |
| CCC.LB.CP07 | WebSocket Support | The service can proxy WebSocket connections between clients and backend targets. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.LB.TH01 | Unrestricted Request Traffic Overwhelms Downstream Services | Absence of filtering or rate limiting permits traffic to overload downstream services and facilitates brute-force activity. |
| CCC.LB.TH12 | Application-Layer Inspection Is Absent or Bypassed | The web application firewall may not be attached to the listener, may run in detection-only mode, or may be bypassed by traffic that is passed at layer 4 or carried over an upgraded WebSocket connection. Malformed or exploit payloads then reach backend targets without inspection, compromising the integrity and availability of those targets. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.LB.CN11.AR01 | When a listener is internet-facing and serves HTTP or HTTPS traffic, a web application firewall policy MUST be associated with it. | tlp-green, tlp-amber, tlp-red |
| CCC.LB.CN11.AR02 | When a web application firewall policy is associated with a listener, the policy MUST run in blocking (prevention) mode rather than detection-only mode. | tlp-amber, tlp-red |