• United States

Crankin’ up the heat

Nov 10, 200310 mins

New Web application firewalls give you the chance to burn Port 80 hackers.

Industry statistics show that 80% of malicious attacks target Port 80, the Web traffic pass-through. Why, then, does the onus for Web application protection still fall largely on network-layer devices? Web applications clearly need special security.

Firewalls specifically designed to protect Web applications would recognize a hacker’s attempt to create a buffer overflow, to inject false SQL or system commands in program variables, or to otherwise manipulate the datastream for ill purposes. Web application firewalls see the breaches that a network-layer firewall (or intrusion-detection system) is not capable of detecting.

Security experts have begun to call the Web application firewall a must-have.

“I would never deploy a Web application today if I haven’t deployed a Web application firewall,” says Ravi Ganesan, vice chairman of NSD Security, which helps user organizations build secure Web infrastructures.

Training Web developers to build secure applications and to conduct initial and periodic vulnerability tests are musts, but don’t suffice. Ganesan equates doing those things but not also deploying a Web application firewall to calling Windows or other operating system secure and throwing out the perimeter firewall. “You’d be crazy,” he says.

Ed McNachtan, program manager with the Family and Children First (FCF) office serving Montgomery County, Ohio, can testify to the benefits of Web application firewalls. He discovered them early – four years ago, when FCF used Health Insurance Portability and Accountability Act (HIPAA) draft documents to perform a Gap Analysis of the security architecture it planned to use for interagency communications via the Web. “We found our security plan failed around Web applications, and we needed to make reasonable efforts to block that hole,” McNachtan says.

He is using AppShield, a software-based Web application firewall from start-up Sanctum, to protect two particularly complex and politically touchy applications that have taken years to develop. The first, in pilot tests now, is a family violence cross-jurisdictional database application. The second is a collaborative case-management application that will go into pilot tests by year-end. “We have privileged and confidential information that we have to protect, plus HIPAA rules and guidelines to follow,” McNachtan says. “I’m married to AppShield. It does a great job.”

Other early users likewise are enamored with their Web application firewalls. Speaking of the APS-100 appliance from Teros, another start-up, one user, who asked not to be named, says, “The cool thing is, it actually found a problem with the application itself – the way we were passing URL strings. It debugged our application!”

This network design engineer, who is working on an outsourced state Medicaid claims-processing application, considers the use of a Web application firewall a competitive advantage. “The need to have a [Medicaid claims-processing] application that works is half the story. The other half is that it’s secure and reliable, and the Web application firewall is one of the pieces telling that part. This is going to make a huge impact for us [in winning business],” he says.

Other users also see the Web application firewall as a tool for winning business. “The confidence we get having the Web application firewall when a potential customer comes in – we can really go to the bargaining table,” says Todd Bowersox, Web operations manager at Agile Software, a product life-cycle management vendor in San Jose.

Web application firewalls at work

Web application firewalls are tuned to stop hackers intent on exploiting Web application vulnerabilities. The attacks described here would be sensed by a Web application firewall, but typically not by a traditional security device.
Attacks and exploits Description User impact
Unvalidated parameters Malicious or erroneous client-side data is accepted without validation. Hacker can hijack client accounts, steal data and obtain private information.
Command and SQL injection Web application passes SQL commands to back-end databases. Hacker can trick the database into dumping all account information.
Buffer overflows Inject and execute shell code by overflowing buffers. Hacker can crash the server or take complete control, as in the cases of the Code Red and Nimda attacks.
Cross-site scripting Breaks trust relationship between client and server. Customer credentials and information can be compromised and their identities stolen.
Forceful browsing Client accesses unauthorized and unadvertised URLs. Hacker can get access to root directory or other off-limit areas.

Having a Web application firewall rates big with potential customers in the systems audits Agile undergoes during its sales cycle, Bowersox says. Audits of vendor systems are common among U.S. Food and Drug Administration-regulated medical device manufacturers, one of Agile’s target customer bases, he says. “The value that the Teros firewall adds is immeasurable,” he says.

Besides a polished image, Agile also gains protection for its Web site and some internal Web applications. A consultant presentation on Port 80 vulnerabilities “lit the flame and got us thinking about and looking into Web application firewalls,” Bowersox says. “We didn’t want to get caught with our pants down, especially with some of our clients coming in and asking, ‘What are you doing about security?’ “

Technology sparks

Web application firewall vendors are divided into two camps: software and hardware. Software vendors include eEye Digital Security, KaVaDo, MultiNet, Sanctum, Turillion Software and webScurity. Hardware vendors include MagniFire WebSystems, Permeo, Teros and Whale Communications.

Thomas Powell, a Web developer who has tested Web application firewalls for the Network World Global Test Alliance , says software-based Web application firewalls are a good choice for those with only one or two servers. Proximity might be an advantage because a software product would reside on the same Web server as the applications it’s protecting, Powell says. Software-based products are also relatively inexpensive – with freeware versions even available.

But a hardened Web application firewall becomes almost mandatory for large organizations, he says, citing KaVaDo’s InterDo and Sanctum’s AppShield as possible exceptions. In Powell’s August test of six software-based Web application firewalls, AppShield won our World Class award for its dynamic policy generation and strong default configuration. InterDo came in a strong second because of its “extreme flexibility.” Each stood out among the rest “for their ability to defend against attacks.” (Powell, who is CEO of Web development firm PINT in San Francisco, will test hardware-based Web application firewalls early next year.)

Web application protection in practice

Web application firewall functionality comes in purpose-built hardware appliances, as server software or integrated into broader network security or switching platforms. You won’t find an easy right choice, as the hardware, software or platform decision depends on existing network and security architectures and application protection require-ments. Factors to consider include cost, scalability, comfort level with vendor, performance, impact on transaction processing and type of application protection provided.
MagniFire WebSystems’ TrafficShield
Permeo Application Gateway
Teros’ Teros-100 APS
Whale Communications’ eGap Application Firewall
EEye Digital Security’s SecureIIS
KaVaDo’s InterDo
MultiNet’s iSecureWeb
Sanctum’s AppShield
Turillion Software’s eServer Secure
As part of a multi-purpose security or switching device
Cisco PIX Security Appliance Series
Check Point Software’s Check Point Next Generation with Application Intelligence
CyberGuard’s firewall/VPN products
Nauticus Networks’ N2000 and N2000V switches
NetContinuum’s NC-1000 Web Security Gateway
NetScaler 9000 Secure Application Gateway
Nortel’s Alteon Switched Firewall
Radware Application Switch with FireProof
Symantec Gateway Security 5400 Series

Besides choosing between hardware and software, users investigating Web application firewalls have to decide whether they want to use whitelisting or blacklisting.

Powell says he favors the more-sophisticated whitelisting approach of mapping an application to determine what requests and inputs are allowable, and then blocking everything else. But he cautions that whitelisting products can require fine-tuning to get that application map correct. “The challenge [with whitelisting] is, unless the site is very well-constructed, it’s not possible to have a perfect idea of the application,” he says. “If a site is poorly developed, then there’s the potential for false positives.”

Like anti-virus software, blacklisting products look for common attack signatures and, if found, either warn security managers or block the user. One downside of blacklisting is that unless the signature list is 100% up-to-date bad queries can get through, Powell says. Another is vendor lock-in, he notes. Because those signature files need regular updating, blacklisting tends to keep users engaged with one Web application firewall vendor. Powell recommends limiting blacklisting use to instances where false positives must be avoided.

Igniting the market

Early users of whitelisting firewalls say that the application-learning process hasn’t been perfect. But users interviewed for this story say their vendors excel at problem resolution and customer service – a start-up’s fortes. In fact, while Web applications themselves are hardly new, their growing importance has created a hotbed of start-up activity. No fewer than two-dozen known start-ups are addressing the Web application protection problem.

Of course, established network vendors aren’t letting newcomers walk into this market unchallenged. Check Point, Cisco, NetScreen Technologies, Nokia and Symantec are among the security vendors enhancing their platforms with more intelligent assessment of application traffic. Meanwhile, F5 Networks, Nortel and Radware are claiming Web application security as a function of their content switches.

But there’s also a whole crop of other start-ups crafting more multipurpose platforms of which Web application protection is but one function. Vendors of this ilk include NetContinuum and Neoteris. The idea of imbuing familiar security devices with application-layer protection has its user appeal.

LandAmerica Info1, Mortgage Credit Reporting, the fourth largest mortgage credit reporting provider in the U.S., plans to use Check Point Next Generation with Application Intelligence for Web application protection, says Jim Noble, director of networks and security at the Norcross, Ga., company.

LandAmerica Info1 began offering Web access to credit reports four years ago. “We started using Check Point prior to September 1999 to protect our networks and systems,” he says, “and that’s one of the reasons we’re going with NG-AI today. It’s the next functional upgrade.”

Noble says the enhanced Check Point network-layer firewall delivers much better cost-performance than a purpose-built Web application firewall. “CheckPoint NG-AI meets our business needs to protect and secure our information” he says.

No matter which platform choice they make, extended enterprises must address the question of Web application protection, and soon, security experts summarize. “You’ve got to have a Web application firewall,” says Richard Stiennon, an analyst at Gartner. “New e-commerce services will just be too vulnerable without something like that.”

And most industry watchers say cost shouldn’t be an prohibitor for large corporations. “You’re probably looking at a five-figure investment [for a hardened Web application firewall], so there’s no reason not to have something,” says Eric Ogren, analyst at The Yankee Group. Yankee recommends doubling up on your Web application firewalls for high availability, placing an investment at about $50,000, or $25,000 per firewall.

“Considering we’re talking about devices meant to secure your way of doing business, it’s easy to justify a $25,000 investment,” Stiennon says. “My advice is: Buy a Web application-specific firewall today and install it in front of all your Web servers as soon as you can.”