Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Application Security

Web Application Firewalls: Three Benefits You May Not have Considered

In my previous column I touched on the point of implementing Web Application Firewalls (WAFs) as part of a measure to prevent clickjacking. I thought I would expand on the benefits of WAFs, and why they can make all the difference between a safe organization and one that’s been compromised. Many IT managers and CIOs still grapple with WAFs because they are expensive and a bear to maintain.

In my previous column I touched on the point of implementing Web Application Firewalls (WAFs) as part of a measure to prevent clickjacking. I thought I would expand on the benefits of WAFs, and why they can make all the difference between a safe organization and one that’s been compromised. Many IT managers and CIOs still grapple with WAFs because they are expensive and a bear to maintain. They’re sometimes deemed unnecessary if other security practices such as proper secure software development and code review are present. If you’re running on a limited budget or resource pool, you may have moved WAFs into the “want to have” bucket out of the “need to have.” I suggest you take another look, and here are three reasons why.

Protection Against Zero-day Exploits

Benefits of Web Application FirewallsWAFs are an important piece of layered security architecture to prevent a Zero-day exploit. You might remember last summer when a Zero-day exploit was discovered for TimThumb, a popular image resizing module for WordPress. TimThumb is included in numerous WordPress plugins and themes. The remote file vulnerability included in this instance was the result of flawed programming logic that essentially allowed anyone to upload any file and execute it in the TimThumb cache directory. This led to countless compromised WordPress installations. The lesson here: you’re not always in control of the software you’re using, and therefore, not in control of its security. If a Zero-day exploit is dropped, you are now at the mercy of that software developer to come up with an official patch, or you have to remove the functionality all together. If you’ve deployed a WAF, you can virtually patch the vulnerability and protect your infrastructure until the vendor has released a patch, or until you can properly patch the code yourself.

Automated Temporary Patches

You’re likely (hopefully) running vulnerability scans quite often. Depending on the nature of your business and your available resources, you may be running scans once a quarter or several times a month. So what happens when you discover a vulnerability in your Web application? Some organizations have the manpower to patch or otherwise address the risk immediately. Others simply can’t do that for a host of reasons including lack of technology staff that are experienced with certain vulnerabilities. If your company falls into the latter group, then your organization is at risk as long as that vulnerability is present. Some WAFs have the ability to import your scan findings, and automatically virtually patch your application for immediate protection. This temporary patch isn’t a fail-safe, but it’s enough to mitigate risk until you’re prepared to address it with something more permanent.

Stops Data Leakage

Hackers have quite a few ways to export data, and unless you know you’ve been compromised, detecting that exfiltration can be tricky. Data leakage can be caused by something as insignificant as a verbose error message presented to a public application user. If your application is harboring source code, credit card numbers, health information or other critical data, then a simple leak can turn into a catastrophe. In this instance, a WAF would be like an x-ray machine — scanning everything that is returned as a response to your Web application users. If the WAF finds something it doesn’t like, then it’s flagged and stopped from leaving your network. Most WAF vendors write high-level behavioral signatures looking for credit card numbers and social security numbers. You can also write additional signatures looking for anything you don’t want to leave your network. Examples may include vital record information, source code, and certain files names.

These are just three examples, but there are numerous reasons to consider bringing Web Application Firewalls into your security program. I urge you to do your research. If you can find a way to deploy these firewalls it can be well worth the cost, even if you think your organization isn’t a terribly high risk.

Advertisement. Scroll to continue reading.
Written By

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Understand how to go beyond effectively communicating new security strategies and recommendations.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...

Application Security

PayPal is alerting roughly 35,000 individuals that their accounts have been targeted in a credential stuffing campaign.

Application Security

GitHub this week announced the revocation of three certificates used for the GitHub Desktop and Atom applications.

Application Security

A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.