Web App Firewalls: How to Evaluate, Buy, Implement

. For Jack Nelson, IT director of global network services and operations at Jarden Consumer Solutions, a big reason for choosing the Check Point Software Technologies VPN-1/FireWall-1 gateway with integrated Web intelligence technology was that it was available in both configurations. Jarden has remote offices that are not staffed by IT workers, so Nelson uses the software-based version to make it simple for office managers to reconfigure any PC to become a WAF if the existing WAF goes down. "It's a lot more flexible than having to purchase a second firewall, and it's less expensive than paying for quick-response maintenance," he says. The interface is simple enough that it doesn't require a firewall expert, he says, and licensing is key-based, so you can apply it remotely.

In a couple of small offices in North America, Nelson uses the Check Point appliance because he finds it more manageable and support is more available.

Inline or out-of-band deployment. It's critical to decide up front whether you plan to deploy the WAF inline or out-of-band, as not all WAFs support both modes. "I often see short lists that consist of products with different deployment modes, or lists where none of the products would support the design being envisioned," Young says.

. It's important to understand the difference between vendors that incorporate WAF capabilities into their existing application delivery and network security products versus those that specialize in application security. Deciding which is right for you depends on many factors, including what you've got installed already, the level of security you need and whether you're more comfortable with specialized products or those with broad functionality.