Network Security - External endpoints protected by a WAF

Description

The metric measures the proportion of external-facing endpoints shielded by a Web Application Firewall (WAF), highlighting an organization's ability to prevent unauthorized access, mitigate threats like SQL injection and cross-site scripting, and safeguard critical systems from cyberattacks, making it a key indicator of external-facing application security.

How we measure it

Find all DNS records in Cloudflare that can be proxied (A, AAAA and CNAME records for web endpoints). Records are considered compliant if they are proxied through Cloudflare, which places Cloudflare's WAF in front of the endpoint.

Meta Data

Attribute	Value
Metric id	ns_waf
Category	Network Security
SLO	90.00% - 95.00%
Weight	0.5
Type

References

Framework	Ref	Domain	Control
CIS 8.1	13.3	Network Monitoring and Defense	Deploy a Network Intrusion Detection Solution
ISO 27001:2022	A.8.20	8 Technological controls	Networks security
NIST CSF v2.0	PR.IR-01	Technology Infrastructure Resilience (PR.IR)	PR.IR-01: Networks and environments are protected from unauthorized logical access and usage

Code

SELECT
  name || ' (' || type || ')' AS resource,
  'dns_record' AS resource_type,
  CASE WHEN proxied THEN 1 ELSE 0 END AS compliance,
  CASE WHEN proxied THEN 'Proxied through Cloudflare' ELSE type || ' record is DNS only, not proxied through Cloudflare' END AS detail
FROM {{ ref('cloudflare_dns_records') }}
WHERE proxiable