The pros and cons of application firewalls

Application firewalls or proxies certainly do offer several advantages over packet filter and stateful packet inspection firewalls. Although these types of firewalls can prevent various network-level attacks, they cannot block the gaping holes found in most Web applications that allow hackers to attack Web sites directly through URL manipulation. However, they can permit or deny specific applications or specific features of an application given a great degree of granular control. Application firewalls can also authenticate users directly. This means, for example, that they can allow or deny a specific incoming telnet command from a particular user, whereas other firewalls can only control general incoming requests from a particular host.

They also provide better content filtering capabilities as they have the ability to examine the payload of the packet and make decisions based on actual content. Having the ability to examine the entire network packet rather than just the network addresses and ports means they have more extensive logging capabilities too, such as application-specific commands, which provide valuable information for dealing with security incidents and policy implementation.

So, given these obvious security advantages why aren't application firewalls the default option? Well, the main reasons are cost and performance. Since all incoming and outgoing traffic is inspected at the application level, it must pass through all seven layers of the OSI model prior to being inspected, whereas packet filtering and stateful packet inspection methods just look at traffic at the network layer. Because the firewall must consume CPU cycles reading and interpreting each packet, the inspection process requires more processing power, which has the potential to become a bottleneck for the network. This means application firewalls are more susceptible to distributed denial-of-service attacks and therefore are less suited to high-bandwidth or real-time applications. The firewall can also be vulnerable to the security loopholes of the underlying operating system.

Another disadvantage of application firewalls is that each protocol, such as HTTP, SMTP, etc., requires its own proxy application, and support for new network applications and protocols tends to be limited. Although most firewall vendors provide generic proxy agents to support undefined network protocols or applications, they tend to allow traffic to tunnel through the firewall, negating many of the reasons for operating an application firewall. Alternatively, stateful packet inspection firewalls, like packet filtering firewalls, have very little impact on network performance, can be implemented transparently and are application independent. Scalability can also become a problem as the number of clients or the number of proxies increases. Application firewalls typically require clients on the network to install specialized software or make configuration changes to be able to connect to the application proxy. This can have quite an impact on larger networks. To reduce the load on the firewall, a dedicated proxy server may be needed to secure less time-sensitive services, such as e-mail and most Web traffic adding to the overall costs.

Hopefully you can see why an application firewall might not be the obvious choice for everyone, but what about the positive model you also mention in your question? The two approaches for an application firewall are a positive security model, which enforces positive behavior and a negative security model, which blocks recognized attacks by relying on a database of known attack signatures. The weakness in the negative model is that it provides no defense against newly discovered exploits and it tends to become an almost daily race against time to keep the signature database up-to-date. Unlike a negative security model, where all behaviors are legal except what is known to be illegal, the positive security model focuses instead on the allowed actions a user may perform, i.e. everything is illegal except what is known to be legal. Although the positive model is certainly the preferred approach, products that use this model are generally more expensive and sophisticated than those that don't. So again, it comes down to money and time.

Related Information