Its browser-based LiquidCredit Bank2Business, for example, is a hosted service for small business loans used by over 150 U.S. banks. About two years ago, “we first went out and looked into the market for a reverse proxy solution,” says Eric Beasley, Baker Hill’s senior network administrator. The company has a three-tiered architecture, all based on Microsoft products.
“We have Microsoft IIS for our Web component, of course our middle tier uses COM/DCOM objects, and our third tier is Microsoft SQL Server 2000.” “Because of [our] reliance on Microsoft, we had some of the larger clients that we were pursuing at the time balk,” Beasley says. “They did not feel comfortable with a purely Microsoft environment, and especially two years ago, when there were so many reported Microsoft IIS vulnerabilities.”
Beasley began investigating ways of making these potential customers happy. “Some of these clients even went to the extreme of saying we will not do business with you unless you put something out in front of this environment to mitigate the fact that it’s all Microsoft.” While the approach “did a good job of getting in between our client and the Web servers,” he says, it didn’t guard against “SQL injection, forceful browsing, and the like.”
So Baker Hill shifted its focus to Web-application firewalls, a relatively new class of products two years ago, now available from such manufacturers as Imperva, Kavado, Sanctum, and Teros (then known as Stratum8). Baker Hill created a test environment, tested products from Kavado, Sanctum, and Teros, and selected the Teros Gateway.
“The Web application firewall learns what is acceptable use of our Web application, and then by default, it will deny all traffic that does not meet the behaviors it’s learned.” Since this approach doesn’t rely on signatures, he says, it helps eliminate zero-day exploits, an especial concern in his Microsoft environment.
One benefit of this technology isn’t just to stop help block attacks, but to give IT more time to test patches before implementing them. In essence, the firewall acts as like a virtual patch.
Gartner estimates that 70 to 80 percent of all attacks today focus on the application layer; Web applications are at risk.
“Virtual patching is designed to address that window.”
Some firewalls, such as Kavado’s InterDo, can also integrate with Web application scanners—in this case, Kavado’s ScanDo—to build a profile of the application in the test or audit environment.
“From a patch standpoint, we no longer feel the need to deploy the Microsoft patches immediately after they’ve been released,” says Beasley. “The reason that I feel a lot more comfortable in not pursuing a strategy like that is there is no 100-percent guarantee that the patch is going to leave your application in a working state,” he says. Without a Web-application firewall, Beasley says he’d have to perfect some other plan for patching, one that takes into account the fact that some Microsoft patches—even if they don’t work—are not meant to be uninstalled. “Then you really have to look at what kind of strategy are you going to use to create some kind of snapshot or backup of that server prior to the patch being applied,” he says.
http://www.esj.com/news/article.aspx?EditorialsID=1273