Web Server Protection

Question

Hi Community Members, 
 I hope this message finds you well. 
 I am currently exploring the best practices for protecting web servers, particularly in scenarios where the firewall is not acting as the gateway, The XGS also acting a reversed Proxy.. Your expertise and insights would be greatly appreciated. 
 Could you please share your recommendations and any effective strategies you have implemented in such setups? 
 Thank you for your support and guidance.

Vivek Jagad · Answer

Hi Michael9609 ,

Thank you for reaching out to the community, Sophos XG Firewall’s Web Application Firewall (WAF) feature protects web servers deployed in a network and related applications from any underlying vulnerability exploit. It protects applications accessed via HTTP and HTTPS at the Layer 7 - Application Layer. Besides Layer 7 based attacks, the web server is safeguarded against cookie tampering, forceful browsing, and hidden field tampering. The WAF also mitigates user-induced vulnerabilities in applications that leave web applications open to attacks, such as cross-site scripting, directory traversal, and forced URL browsing."

Please refer the following docs:
> Sophos Firewall: Avoid RDP brute force attacks.
> Web server protection (WAF) rules.
> Add a web server protection (WAF) rule.
> Sophos Firewall: WAF troubleshooting scenarios.

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience