Web App Firewalls: How to Evaluate, Buy, Implement

Here are the attributes that a WAF should have, according to a list provided by Ofer Shezaf, founder of research and consulting firm Xiom:

* Have intimate understanding of HTTP. WAFs need to fully parse and analyze HTTP to be effective.

* Provide a positive security model. A positive security policy allows only traffic known to be valid to pass through. Sometimes called "whitelisting," this provides an external input validation shield over the application.

* Application-layer rules. Because of the high maintenance cost, a positive security model should be augmented by a signature-based system. But since Web applications are custom-coded, traditional signatures targeting known vulnerabilities are not effective. WAF rules should be generic and detect any variant of an attack, such as SQL injection.

* Session-based protection: One of the biggest downsides of HTTP is the lack of a built-in reliable session mechanism. A WAF must complement the application session management and protect it from session-based and over-time attacks.