Trustwave's 2024 Retail Report Series Highlights Alarming E-Commerce Threats and Growing Fraud Against Retailers. Learn More
Get access to immediate incident response assistance.
Get access to immediate incident response assistance.
Trustwave's 2024 Retail Report Series Highlights Alarming E-Commerce Threats and Growing Fraud Against Retailers. Learn More
It always pays off to visit Richard Bejtlich's blog once in a while. (Or, even better, subscribe to his RSS feed and get updated in real-time.) A short visit today uncovered a plethora of information relevant to web application security and web application firewalls.
First, there is this post, where Richard shares a few thoughts from his discussion with Marcus Ranum, on the subject of proxies as security devices (which is what web application firewalls are).
Something Marcus said stroke a cord with me (emphasis mine):
"Proxies keep cropping up over and over, because they are fundamentally a sound idea. Every so often someone re-invents the proxy firewall - as a border spam blocker, or a 'web firewall' or an 'application firewall' or 'database gateway' - etc. And these technologies work wonderfully. Why? Because they're a single point where a security-conscious programmer can assess the threat represented by an application protocol, and can put error detection, attack detection, and validity checking in place."
You should also read Marcus' thoughts on deep packet inspection firewalls. Proxy-based application firewalls were hot stuff a decade or so ago but they lost to network firewalls. They came back to fashion as "web application firewalls" because of terrible insecurities present in most web applications today.
The other interesting post discusses the convergence of application firewalls and network firewalls, in response to the extensive coverage of network firewalls at the Network Computing magazine. The basic sentiment is that application firewalls and intrusion prevention are just network firewall features, and that customers simply do not want or need to run two devices.
Trustwave is a globally recognized cybersecurity leader that reduces cyber risk and fortifies organizations against disruptive and damaging cyber threats. Our comprehensive offensive and defensive cybersecurity portfolio detects what others cannot, responds with greater speed and effectiveness, optimizes client investment, and improves security resilience. Learn more about us.
Copyright © 2024 Trustwave Holdings, Inc. All rights reserved.