Port80 Software, makers of Web application firewalls for Microsoft IIS Web servers, will soon be releasing a new product that supports IIS version 7. They promise the new application firewall, ServerDefender VP, will protect enterprises from the top 20 Internet Security Attack targets listed by SANS. ServerDefender VP was actually released this month, says Port80's Chris Neppes, with support for versions 5 and 6 of IIS (servers 2000 and 2003). Support for IIS 7 will be available when Windows 2008 launches in February, Neppes says.

Port80 Software makes other application firewalls, but VP is different in that it is not signature based. It is behavior based. This means that it protects the application layer (ASPX, PHP, CFM, JSP, etc.) and databases from Web-based attacks by verifying that the behaviors of pages and applets flowing through the Web server do not vary from accepted norms. It won't for instance, allow a Web page to automatically run a script or install code on the users' machine. Neppes says that the VP product protects against SQL Injection, cross-site scripting (XSS) and request forgery (CSRF), directory traversal, brute force, denial of service and privilege escalation.

The cool thing about this software app firewall is its price … it will only set you back $350 per server.