Overview

IO River provides consistent security services at the edge. These services are managed via the IO River console and include:

• Managed WAF – Choose between:
  • IO River WAF - Pre-configured security rulesets that protect against common web threats. Provides out-of-the-box coverage for vulnerabilities like SQL injection, XSS, and known attack patterns, reducing the need for manual rule creation and ongoing maintenance.
  • Check Point Machine-Learning WAF - A next-generation ML-based Web Application and API security (WAAP) service, automatically distinguishes between legit and malicious traffic, and provides safeguards against suspicious activity, API abuse, bot traffic, and zero-day attacks with minimal manual tuning.
  • Check Point Rule-based WAF - A rule-based engine that can prevent suspicious activity, based on rules and provides safeguards against threats such as OWASP Top 10.
• Custom Rules – Allow you to define specific conditions and actions to inspect and control incoming web traffic.
• Rate Limiting – Controls the number of requests a client or IP can make to your application within a specified time window. Helps protect against abuse, credential stuffing, DDoS attacks, and excessive API calls by automatically throttling or blocking traffic that exceeds the defined limits.
• Bot Management - Intelligent protection against automated bot traffic, ensuring that only legitimate human users can access your content and APIs.
  • Bot Prevention - Prevent bots from entering pages in your website or executing actions in your web application.
  • Bot Visibility - Identify well-known, i.e. verified bots and similar bots, that access your website.

Security services are executed in the following order:

1. Custom rules (incluiding bot prevention)
2. Rate limiting
3. ML-based WAF
4. Managed WAF (standard rules)

Enabling Security Services

Security services are disabled by default for new services. You can enable them at the service level via the IO River console.
Please note that IO River's security services use edge compute, which may incur additional costs from your CDN provider.

To enable security services for your service:

1. Navigate to your service.
2. In the sidebar, select Security, then select WAF.
3. Click Enable Edge Security.

Note: Security services must be enabled for your account before enabling them for a service. You can contact us at support@ioriver.io to enable this feature.

Customizing the Security Services

Requests that are blocked by any of the IO River security services (WAF or custom rules) return an HTTP error response to the client. By default this response is a standard HTTP 403 Forbidden error, but you have the option to customize such responses.

To do this, you will need to define a custom response, and then set the engine (WAF or a custom rule) to use this response. You can create multiple custom responses that can be used in various situations.

Create a Custom Response

1. Navigate to your service.
2. In the sidebar, select Security, and then select Security Settings.
3. Click the Add button.
   • Name - This will allow you to identify this response when you use it later.
   • Status Code - The HTTP status code that will be returned to the client.
   • Headers - Define headers, name and value, that will be included in the response (headers are optional).
   • Response Body - The response body, you can either type it in the text field, or upload a file with the response body (body is optional).
4. Click Save

Note: the response body can be text, HTML, or anything, and it can be empty.

If you want to redirect the client to another page when the request is blocked, choose an HTTP status code 301, 302, 303, 307, or 308, and add a header called Location with the value of the target page URL.

Use the custom response

To set the default response when a page is blocked:

1. Navigate to your service.
2. In the sidebar, select Security, and then select WAF.
3. Select the Configure tab.
4. Set the Response field to the custom response you want, or leave it as the standard 403 reponse.

To override the reponse when a request is blocked by a custom rule:

1. Navigate to your service.
2. In the sidebar, select Security, and then select WAF.
3. Select the Custom Rules tab.
4. Add a new custom rule or edit an existing one.
5. Set the action to BLOCK, and select the custom response you want, or leave it as the standard 403 reponse.

Ship Security Logs for Offline Analysis

If you need to maintain the logs from the security engines for longer duration, or for analysis offline, IO River can ship the security events to you log destination of choice.

See Streaming of Traffic and Security Logs for details.