Barracuda has joined the main stream WAF market by releasing two new models that compete with popular mid-range Imperva and Breach Security models.
My Web 2.0 Top Security Threats List
By Ofer Shezaf - Posted on February 25th, 2009
Tagged:
I have written for the Open Group's Secure Enterprise 2.0 group a white paper about Web 2.0 security threats.
Discussing Web 2.0 security is difficult as Web 2.0 itself is somewhat blurry term. Most discussion on Web 2.0 security tends to be on the technical level, however Web 2.0 is not a technology, but rather a concept. When researching the issue, I was surprised to find out that Tim Barnes-Lee's, the Web conceiver views the original web as the 1st Web 2.0 implementation. After considering this, I tend to agree. Wikis are for sure a Web 2.0 application and they exist since 1994.
ModSecurity Works!
By Ofer Shezaf - Posted on February 19th, 2009
Tagged:
Well sure it works. However a short blog entry of an insulted WordPress lover shows that it also delivers security.
The story is quoting a hosting provider recommending to a client to be very careful with a WordPress installation as it is often defaced, and the reason? WordPress does not work well with ModSecurity and therefore an exception is needed to remove ModSecurity protection. This results in the WordPress site being defaced more often...
Fortinet Joins the WAF Market
By Ofer Shezaf - Posted on February 19th, 2009
More players are welcomed news in the WAF market, a market which seems to be aging in its infancy. Therefore Fortinet entry to the market is certainly good news. As a company that is positioned to join the big three firewall vendors, Fortinet can certainly provide much needed credibility to the WAF market. Saying that, we must recall that Cisco entry into the WAF market last year made little impact on the market place, probably due to an overprices but underpowered offering.
Wiki Security
By Ofer Shezaf - Posted on February 2nd, 2009
Tagged:
Wiki is a foster son of the Web 2.0 trend. Invented well before the web became common, let alone Web 2.0, Wikis do not have fancy interfaces and 21st century aura. However with real group collaboration, Wikis are one of the technologies most associated with Web 2.0.
What is a Web Application Firewall?
By Ofer Shezaf - Posted on January 5th, 2009
Tagged:
Why a Definition?
Web applications firewalls are not new. The 1st one was introduced in 1997. But web application firewalls did not receive significant market attention until recently.
One of the primary drivers for web application firewalls adaption today is the Payment Card Industry Data Security Standard or PCI for short. PCI offers WAFs as one of two methods to protect web applications, the other being code review. However, until February 2008 PCI fell short of describing what a WAF is and, and discussed later, the clarification provided is hardly sufficient.
Client Side Web Server Hacking
By Ofer Shezaf - Posted on January 28th, 2008
Last week Symantec reported an active exploit of Cross Site Request Forgery (CSRF) against residential ADSL routers in Mexico (WHID 2008-05). In this attack, an e-mail with a malicious IMG tag was sent to victims. By accessing the image referenced by the e-mail message, the user initiated a router command which changed the DNS entry of a leading Mexican bank, making any subsequent access by a user to the bank go through the attacker's server. For the Web Hacking Incidents Database (WHID) this type of attack presents a new category: until now WHID included attacks against servers and ignored attacks against clients. After all, this is the Web Hacking Incidents Database.
The closest WHID got to client side attacks were incidents in which a web site was hacked and a malicious code was inserted to abuse clients, such as the Dolphins Stadium Incident (WHID2007-10). WHID 2008-05 somewhat blurs the lines: while the attack is definitively against clients, and the bank is only indirectly involved, it is technically a web hack and demonstrates the need for better web application security.
The reason if of course that technology blurs the lines: when installing ADSL routers at customers’ premises we place a sophisticated piece of equipment at their hands. Neither the developers nor the service providers give the necessary attention to the security implications of this, making our computing environment much less protected than ever.
Another example of the same problem was discovered recently by Aaron Weaver who found that printers are susceptible to XSS. To signify this new trend we have added to WHID a new attribute, location, which will describe where the attack takes place. The default when location is not specified is server, while for WHID 2008-05 the value would be client. Another possible value for this attribute is proxy or service provider if the attack occurs somewhere along the way.
