Choosing the right Web application firewall - Information Security Magazine - Page 1

Choosing the right Web application firewall

Enterprises rushing to meet PCI compliance requirements may find themselves in a quandary when it comes to choosing a Web application firewall (WAF). How do you know what to look for? How do you deploy and manage the appliance or software effectively? How do you fit it into your existing infrastructure? We'll highlight the key considerations when evaluating products so your company is in compliance. .

A Web application firewall or application-layer firewall is an appliance or software designed to protect web applications against attacks and data leakage. It sits between a Web client and a Web server, analyzing application layer messages for violations in the programmed security policy. Web application firewalls address different security issues than network firewalls and intrusion detection/prevention systems, which are designed to defend the perimeter of a network. But before you rush to buy, you'll need to understand that this is not a plug-and-play check box compliance item and requires more than just putting an appliance in front of your application servers.

    Requires Free Membership to View

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

Step by Step: Choosing a WAF
Follow these basic steps in selecting the appropriate Web application firewall for your application:

  1. Use security policy objectives to define what controls your WAF must have.
  2. Review the types of risk each product covers.
  3. Test performance and scalability.
  4. Evaluate the vendor's technical support.
  5. Assess whether you have the required in-house skills to maintain and manage it.
  6. Balance security, throughput, and overall cost.

--Michael Cobb

This was first published in March 2009