如何评估并部署web应用防火墙（How to evaluate and deploy the web application firewall）.doc

如何评估并部署web应用防火墙（How to evaluate and deploy the web application firewall） Web application firewall (WAF) to protect Web applications against common attacks (such as XSS attacks and SQL injection attacks and other threats). The traditional firewall mainly protects the peripheral part of the network, while the WAF is deployed between the Web client and the Web server. The biggest benefit of the Web application firewall, experts say, is to help analyze the application layer traffic to detect any security issues related to illegal security policies. Although some traditional firewalls provide some kind of application protection, they are not as good as WAF in terms of pertinence and scope. For example, WAF can detect whether an application is running in its prescribed manner and can help you write more specific security policies to prevent the same thing from happening again. WAF and intrusion prevention system (IPS) also has the difference, Gartner analyst Greg Young said, this is a very different technology, it is not based on the signature, but from the behavior analysis, it can help to reduce your own vulnerabilities in manufacturing may unintentionally, The main driver of the current use of WAF comes from the payment card industry data security standard (PCI DSS), which uses two major approaches to review compliance: WAF and code review. Another driver is that more and more people realize that attacks have begun to shift from the network to the application. WhiteHat Security evaluated 877 sites between 2006 and December 2008, and found that 82% had at least some important emergency system severity. The main features of Web application firewall (WAF) Web application firewall market is still not very clear, there are many similar products are classified into the WAF range. Experts pointed out that many products can provide much higher than the firewall function, which makes it difficult to evaluate and compare products.. In addition, new suppliers are beginning to flo