WAF-for-MSPs is an add-on integration to our reverse proxy service to provide web application firewalling for MSP tools.
Security is of the utmost importance for RMM systems, as MSPs continue to be the targets of cybersecurity attacks. New software vulnerabilities are found at an accelerating pace, and zero-day attacks are on the rise. This leaves many MSPs concerned about potential attacks on their tools, like ConnectWise Automate, which has had remotely exploitable SQL injection and XXE vulnerabilities in the past. A WAF is an ideal solution to such attacks, but they are typically complex to implement and tend to have a high rate of false positives.
Here at Automation Theory, we’ve created a WAF module for our reverse proxy service that’s tuned for MSPs. This allows for a drop-in deployment of a WAF where traffic passing through the reverse proxy instance is sent to the WAF for scoring (much like a spam filter). Based on the score, the proxy will pass or block the traffic, seamlessly integrating into the other security layers provided by the reverse proxy.
Features
- Deep inspection of inbound traffic
- Blocking of common exploits (including OWASP Top 10)
- Blocking of suspicious requests (including bots, malformed requests, and protocol violations)
- Fully managed service
- Rules tuned for MSP applications
- Seamless integration with Reverse-Proxy-as-a-Service
A typical MSP application has no native protections against application exploits, and a bad actor with a zero-day vulnerability could trivially launch an attack. A WAF can address this issue and add further layers of security to protect against attack. Below is a recorded webinar displaying this feature set with Connectwise Automate.
WAF attack prevention example
Below is an example of the WAF blocking a SQL injection attempt. When the request is sent, the attack is detected, the proxy responds with a 405 error, and the malicious request never reaches the Automate server.
Getting started
We offer a 30-day trial of our WAF; use the form below to request a trial instance:
Need a quote?
Use our self-service quote form below to get a quote delivered directly to your inbox.