WAFs

Larry Suto, who brought scanners wars 1 and 2 has published a WAF effectiveness research. As usual, Larry’s work is fun to dissect. While Larry’s research is not worse than your average analyst’s work, he does try to base his conclusion on more concrete and pseudo-scientific research making it much more vulnerable to scrutiny.

An interesting case study by Joshua Drummond from UC Irvine compares two open source WAFs, ModSecurity and WebKnight to an unnamed commercial WAF. The results shed light not just on the difference between open source and commercial solutions but also highlight key requirements from a WAF. It seems that the two issues Joshua finds with Open Source WAFs are manageability and positive security. It would be interesting to see if the two new Open Source WAFs on the block would address those shortcomings.

While the Cenzic and Sanctum pen testing patents discussed in an earlier blog article questions the value of information security patents to the society, the classic Sanctum web application firewall patent presents another risk brought on by information security patents: the risk of obscurity.

While securing web applications is a well understood need, and while WAFs have clear advantages over code review and testing such as immediate mitigation and higher automation, the WAF market is still a small market. The attached presentation discusses and offers some explanations to this phenomenon.