WAF · web apps · APIs
Web application firewall for the portals and APIs you publish.
If customers, staff or partners reach an application on your servers over the internet, it needs more than a port rule. We protect it with WAF on the Sangfor firewall platform, roll it out in monitoring mode first, and add managed monitoring so blocked attacks reach an engineer. Missan is a Sangfor Gold Partner.
Talk to our team today. Mon–Sat, Dubai time.
What we do
Protection in front of the application.
Missan is a Sangfor Gold Partner for next-generation firewalls and HCI.
22+ years · 5,000+ clients served since 2004 · 10,000+ projects delivered since 2004
- Application inventory
- Every site, portal and API you publish listed, with its owner, server and the traffic it should accept.
- Attack blocking
- SQL injection, cross-site scripting, file inclusion and other common web attacks blocked before they reach the server.
- Bot and abuse control
- Scanners, brute-force login attempts and abusive request rates throttled or blocked.
- Monitor, then block
- Each application starts in monitoring mode, exceptions are added for real traffic, then blocking is switched on.
- Managed monitoring
- 24/7 automated monitoring and alerting, with engineer response in business hours and agreed out-of-hours cover.
- Testing
- Published applications scanned before and after, so you can see what the WAF covers and what still needs a patch.
How a project runs
Survey, fixed quote, then a staged rollout with a way back.
-
Step 1
Site survey
An engineer visits, records what is installed today and what the business needs from it, before anything is priced.
-
Step 2
Fixed quote
You get an equipment list, the labour, a schedule and one written price. Anything that changes on site is quoted in writing first.
-
Step 3
Staged rollout
One site, floor or group at a time. The old setup stays in place, with a tested way back, until the new one is proven.
-
Step 4
Handover and support
Documentation, admin access in your company’s name and a walkthrough. Then support under an AMC or managed IT if you want it.
After go-live
What managed WAF covers.
- 24/7 automated monitoring and alerting, with engineer response in business hours and agreed out-of-hours cover.
- New applications and changes to existing ones added to WAF protection as support requests.
- False positives investigated and exceptions recorded.
- Signature, subscription and firmware updates tracked and applied in an agreed window.
- A periodic report of blocked attacks per application.
Support runs Monday to Friday 08:30–17:00 and Saturday 08:30–14:00 (Dubai time), with out-of-hours cover agreed in the contract where you need it. We reply within one business day to anything that is not urgent. See IT AMC contracts and managed IT services.
Questions
What buyers ask before they sign.
What is a web application firewall (WAF)?
A WAF sits in front of your websites, portals and APIs and inspects web requests, blocking attacks such as SQL injection, cross-site scripting and malicious bots before they reach the application. A normal network firewall does not look that deeply into web traffic.
Which applications need a WAF?
Anything you publish to the internet from your own servers or private cloud: customer portals, booking and ordering sites, ERP or HR web access, and APIs used by mobile apps or partners.
How do you deliver it?
On the Sangfor firewall platform, with WAF protection enabled for the applications you publish. Missan is a Sangfor Gold Partner for firewalls and HCI.
Will a WAF break our website?
Not if it is rolled out carefully. We start each application in monitoring mode, review what would have been blocked, add exceptions for legitimate traffic, then switch to blocking.
Who watches the alerts?
With managed monitoring, 24/7 automated monitoring and alerting, with engineer response in business hours and agreed out-of-hours cover.
Is a WAF enough on its own?
No. It reduces risk while the application is patched, but does not replace patching or secure coding. We pair it with a vulnerability scan of the published applications through our security assessment service.
Tell us what you publish
The websites, portals or APIs you host, where they run, and your current firewall if you know it. We reply within one business day.
Planning a project? Get it scoped first.
Send us the brief, the deadline and what you have today. An engineer reviews it and we reply within one business day with next steps.