Security Infrastructure

Intrusion-detection systems, Web application firewalls, VPN gear

By Christine Burns and Keith Shaw, Network World, 02/23/04

 Start a discussion    Print article

 Comments (1)    Print article

Winning company: Sanctum
Winning product: AppShield 4.0

Typically the top honor in this category goes to a security vendor that ships a VPN device, network firewall or intrusion-detection system that might provide security to the core network. We're branching out this year with Sanctum's AppShield.

While traditional firewalls thwart network-level attacks, they do little to address gaping holes in Web applications through which intruders can break into Web sites using form submissions or URL manipulations. Enter Web application firewalls, a new class of security product that attempts to put off Port 80-focused attacks by using blacklist- and whitelist-style input filtering.

In our testing of six software-based Web application firewalls conducted last summer, AppShield edged out some stiff competition because - in addition to fending off most Web-based attacks we tossed its way - it's got an airtight default configuration and a cool dynamic policy-generation feature (see review).

Sanctum's AppShield is geared toward Web server farm deployment, as evidenced by its fully distributed architecture. Product components include a crisp Java-based management console, a configuration server and one or more firewall nodes.

Because AppShield can run in a proxy mode, it provides some interesting security-oriented features that go beyond the usual menu of application firewall options, Lab Alliance member Thomas Powell notes. These features include URL mapping (including regular express matching), and the ability to globally prohibit direct downloading of image and multimedia files, often dubbed "leeching." Furthermore, for preventing repeated attacks that violate security policies, AppShield can notify a Check Point firewall that a particular IP address should be blocked at the network level. It uses the Open Platform for Security standard to do so.

"This interesting feature suggests the possibility of application firewalls eventually merging with authorization and access-control functionality to provide a complete application security framework," Powell says.

About Network World, Inc. | Advertise | Careers | Contact us | Terms of Service/Privacy | Reprints and links | Partnerships | Press room | Subscribe to NW

Copyright, 1994-2008 Network World, Inc. All rights reserved.