Web App Firewalls: How to Evaluate, Buy, Implement

Krikken notes that products focusing on application delivery need to perform at wire speeds and thus don't include compute-intensive capabilities such as learning engines and session awareness. "They're very much limited to black-listing and white-listing and inbound/outbound inspection," he says. Learning engines enable the WAF to learn the behavior of an application and generate policy recommendations. Session awareness enables the WAF to build dynamic, session-based rules in real time and use those to determine whether subsequent requests are valid.

For Nelson, who is using Check Point's integrated product for the company's virtual private network and external Web applications, it was important that the product handle a breadth of security components rather than an application-specific firewall. "We wanted the ability to consolidate functionality without sacrificing performance and manageability," he says.

Meanwhile, at automotive parts supplier AutoAnything.com, which is using Breach Security's stand-alone WAF to secure e-commerce, CTO Parag Patel takes the opposite approach. "It's rare that one company can do a lot of things well," he says.

. Many companies are turning to WAFs for . However, analysts warn against seeing a WAF as a check-off item.

"I see a lot of mistakes and bad spending going on," Young adds. "People think, 'If we buy a firewall, the auditors will go away,' but that's not good enough in this area. You have to customize your application defense to fit your environment."