Web App Firewalls: How to Evaluate, Buy, Implement

* Allow fine-grained policy management. Exceptions should be applied to only minimal parts of the application. Otherwise, false positives force wide-open security gaps.

The (OWASP)--an open community focused on improving the security of application software--suggests the following selection of criteria for WAFs:

* Very few false positives (i.e., should never disallow an authorized request);

* Strength of default (out-of-the-box) defenses;