Port80 Software, makers of Web application firewalls for Microsoft IIS Web servers, will soon be releasing a new product that supports IIS version 7. They promise the new application firewall, ServerDefender VP, will protect enterprises from the top 20 Internet Security Attack targets listed by SANS. ServerDefender VP was actually released this month, says Port80's Chris Neppes, with support for versions 5 and 6 of IIS (servers 2000 and 2003). Support for IIS 7 will be available when Windows 2008 launches in February, Neppes says.
Port80 Software makes other application firewalls, but VP is different in that it is not signature based. It is behavior based. This means that it protects the application layer (ASPX, PHP, CFM, JSP, etc.) and databases from Web-based attacks by verifying that the behaviors of pages and applets flowing through the Web server do not vary from accepted norms. It won't for instance, allow a Web page to automatically run a script or install code on the users' machine. Neppes says that the VP product protects against SQL Injection, cross-site scripting (XSS) and request forgery (CSRF), directory traversal, brute force, denial of service and privilege escalation.
The cool thing about this software app firewall is its price … it will only set you back $350 per server.
The Microsoft Subnet blog is the official blog of the Network World's Microsoft Subnet community, and is written by Online Community editor Julie Bort. Microsoft Subnet is the independent voice of Microsoft customers and is your gateway to daily Microsoft news, blogs, opinion, books, prize giveaways and more. Visit the Microsoft Subnet index page daily, and while you are there, subscribe to the Microsoft newsletter. The newsletter includes news generated by the Microsoft Subnet community as well as other Microsoft news stories published by Network World.
The Leader in Network Knowledge
