Title: AWS re:Inforce 2024 - Level up security: Advanced AWS WAF rules & bot detection techniques (NIS223)

Insights:

• Introduction to Bots: Bots are software programs that perform automated tasks on the internet. They can be categorized into good bots, which perform beneficial functions, and bad bots, which engage in malicious activities such as content scraping, account takeover fraud, and card cracking.
• Prevalence of Bots: Over 47% of internet traffic is made up of bots, with 30% of that traffic being unidentified and often involved in malicious activities.
• AWS WAF Managed Rules: AWS WAF (Web Application Firewall) offers managed rules that provide sophisticated bot detection and mitigation. These rules can be deployed with minimal configuration and integrated into web ACL configurations.
• Advanced Mitigation Features: AWS WAF includes advanced mitigation options such as CAPTCHA and challenge actions, which help in verifying if a user is a legitimate browser or a bot.
• Bot Control Rule Sets: AWS WAF offers two levels of bot control rule sets: common and targeted. Common rules manage traffic from good bots and block unverified bots using static request analysis. Targeted rules use advanced techniques like browser interrogation, behavior heuristics, and device fingerprinting, along with machine learning capabilities.
• Specific Use Case Protections: AWS WAF provides specific rule offerings for preventing account takeover attacks and fake account creation.
• Challenge and CAPTCHA Actions: The challenge action involves serving a silent challenge script to verify if the user is a browser. The CAPTCHA action requires the user to solve a puzzle to prove they are human. Both actions help in mitigating bot attacks.
• SDK Integration: For API workloads, AWS WAF offers SDK integration that emulates challenge behavior and fetches tokens proactively. This is available for JavaScript and mobile applications on Android and iOS.
• Demo Overview: The presentation included three demos showcasing AWS WAF's ability to detect and mitigate various levels of bot attack sophistication, from simple HTTP library attacks to advanced browser emulation and credential compromise attacks.
• Key Takeaways: AWS WAF provides comprehensive and battle-tested bot solutions and fraud offerings, with various options for token acquisition and use case-specific protections.

Quotes:

• "Bots are software programs that run on the internet that perform automated tasks."
• "More than 47% of the Internet traffic is made up of bots and they say like 30% of that traffic is unidentified."
• "AWS WAF is our web application firewall. It monitors HTTPS requests and protects your application from commonly occurring web threats."
• "We offer sophisticated bot detections by manage rules. These are one click deploy with little editing and you could have it in your web ACL configuration."
• "The bot detections at this level are a little advanced, a little sophisticated. So we do things like browser interrogation, look at different behavior heuristics and device fingerprinting."
• "With capture action, the token acquisition process happens by making the human or the end user solve a puzzle."
• "For cases like that we offer SDK integration. So the way SDK integration works is it emulates the challenge behavior, but it kind of proactively goes and fetches the token and submits the proof of work."
• "AWS WAF offers comprehensive, battle-tested, and bot solutions and fraud offerings."