Web application firewall is a simple term, but understanding what it means is proving so difficult for customers that an industry consortium is publishing advice on how to make a choice among the many devices that fall into this category.

On Monday, a 20-page document called Web Application Firewall Evaluation Criteria is being published by the Web Application Security Consortium, a group formed a year ago from vendors, consultants and end users. The document will be available here.

Broadly, Web application firewalls examine HTTP and HTTPS traffic at the application layer, looking for attacks masquerading as legitimate application traffic. They defend against attempts to tap sensitive information stored on Web application servers, such as credit card and social security numbers as well as proprietary corporate information.

There are such a wealth and variety of methods for accomplishing this goal that it is difficult for potential customers to figure out what product best suits their needs, says Mark Kraynak, director of product marketing for WAF vendor Imperva who served on the Web Application Security Consortium committee that wrote the document. Other vendors include Citrix, F5 Networks, NetContinuum and Protegrity among others.

"There's too much functionality and only one name for the products," says Kraynak. "A lot of our customers don't know what criteria they should be evaluating. There's confusion."

No single WAF device is appropriate for all networks, says Ivan Ristic, who headed the evaluation effort for the consortium. He also runs Thinking Stone, a Web application security consulting firm. "You need to look at your security requirements and business goals. Create a short list of features you need, and use that to sort products."

For example, a business that needs to document all HTTP transactions for regulatory purposes may need a WAF with very few features, Ristic says. Or a business with a single Web server might need no separate WAF, but only application firewall software that can run on the server itself, he says.

The range of features is broad. A WAF can deal with SSL traffic, for example, by terminating it, examining it and passing it on or capturing it and decrypting it but not terminating sessions. Similarly, if the WAF needs to block traffic, it can terminate network-protocol connections and not pass on malicious traffic or it can sever suspicious connections altogether.

Whitepapers

• Selecting Effective Virtual Directories
• A Modern Approach to On-Demand Email and Data Security
• Best Practices for HP Servers and HP Enterprise Virtual Array in a Microsoft Exchange
• Compliance, Protection, Recovery: A Layered Approach to Laptop Security
• Endpoint Security: Data Protection for IT, Freedom for Laptop Users
• IT Departments on Data Security: A Research Concepts Survey

View more SECURITY whitepapers

Webcasts

• Key Considerations for a Successful 802.11n Deployment
• Solutions to the Toughest IT Challenges in Remote Offices
• Lowering the Cost of Email Archives
• High Availability for SQL Server 2005 Using Array-Based Replication and Host-Based Mirroring Technologies
• Technical Overview of Exchange Server 2007 with HP Servers and Storage
• Bringing Order and Security to your Mobile Workforce: Corporate Mobility Policy and Device Management On-Demand

View more SECURITY webcasts

Special Reports

• The Evolution of Network Security
• Taking Virtualization Up a Notch
• Learn how to Keep your Mobile Workforce Connected
• The self-managed network

View more SECURITY special reports