Perform Application Layer Filtering
Description
Perform application layer filtering. Example implementations include a filtering proxy, application layer firewall, or gateway.
Implementation Checklist
Tool Recommendations
Cloud-native secure web gateway with inline inspection, URL filtering, sandboxing, and DLP for web traffic
Zscaler · Per-user subscription
Cloud-native DLP and CASB platform providing inline data protection for SaaS, IaaS, web, and endpoint
Netskope · Per-user subscription
Next-generation firewall platform with application-aware policies, threat prevention, URL filtering, and SD-WAN
Palo Alto Networks · Appliance + subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Application-Layer Attack Bypassing Port-Based Firewall Rules
IntegrityAn attacker delivers a web application exploit over port 443 that a traditional packet-filtering firewall permits, because no application layer filtering inspects HTTP request content for malicious payloads.
Data Exfiltration Tunneled Through Allowed Application Protocols
ConfidentialityAn attacker tunnels data exfiltration through DNS queries or HTTPS traffic that port-based firewalls permit, succeeding because no application-layer inspection identifies the covert channel.
Malicious File Upload via Permitted Web Traffic
IntegrityAn attacker uploads a web shell to a server through a legitimate HTTP POST request that passes through network firewalls, because no Layer 7 filtering or WAF inspects the content of allowed traffic.
Vulnerabilities (When Safeguard Absent)
No Deep Packet Inspection at Application Layer
Without application layer filtering, network security controls only evaluate traffic at the transport layer, allowing all forms of application-level attacks that use permitted ports and protocols.
Inability to Detect Protocol Abuse and Tunneling
Absence of Layer 7 inspection means attackers can abuse legitimate protocols for command-and-control communication, data exfiltration, and covert channels without detection.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Technical | Firewall rule set export and review documentation | Reviewed quarterly |
| Record | Firewall change request and approval records | Per change |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |