Zack wrote:
The other option from a Web Application Firewall is to
use a black box tester and look for vulnerabilities
within your Web application. I personally think that
is a better approach since you are "fixing" the source
of potential vulnerabilities rather than "hiding" them
behind a firewall.
Are you sure that by black box testing you actually fix the vulnerabilities?
The last time I checked, vulnerability scanners did not claim to modify the
code in any way. I assume you would agree that scanners just point to
vulnerabilities requiring the programmers to fix them. If your web site
operator takes down the site the moment a vulnerability is found and your
programmers fix it within a reasonable time frame to keep the site down (3
minutes?) you are fine with scanners. However I assume that your situation
is different.
While I agree that using scanners to empower programmers to make their code
better, I don't think it is a one stop solution for protection your
application. Application firewalls will enable you to dynamically patch
those vulnerabilities until the programmers come around to fixing them and
provide protection from zero-day attacks until the next time you run your
scanners. My colleague Ivan Ristic wrote just yesterday a blob entry
describing use cases for WAFs:
http://www.modsecurity.org/blog/archives/2008/03/web_application_4.html.
~ Ofer
Ofer Shezaf
Work: ofers@breach.com, +972-9-9560036 #212
Personal: ofer@shezaf.com, +972-54-4431119
VP Security Research, Breach Security
Chair, OWASP Israel
Leader, ModSecurity Core Rule Set Project
Leader, WASC Web Hacking Incidents Database Project
-------------------------------------------------------------------------
Sponsored by: Watchfire
Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web
application security assessments should be considered a crucial phase in the
development of any web application. What methodology should be followed? What
tools can accelerate the assessment process? Download this Whitepaper today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
-------------------------------------------------------------------------
