WEBDEFEND Comprehensive Web Application Security for Large Organizations Customized, behavior-based security for web applications. Provides real-time, continuous web application security. Delivers non-intrusive and effective security—WebDefend is the only sensor that deploys out-of-line and blocks 100% of detected attacks. Automates web application compliance to regulations and industry standards, such as the Payment Card Industry Data Security Standard. Detects security defects that vulnerability scans miss, by passively monitoring web application traffic. Bridges the gap between security and development teams with detailed reporting on sources of vulnerabilities for quick remediation. Learn More If you are using active web content, such as online banking applications, you cannot afford to be without this product. Learn More

MODSECURITY PRO M1100 Essential Web Application Security for Small and Medium-Sized Organizations Essential web application security at an affordable price. Provides immediate protection for production applications against targeted attacks with plug-and-play installation and enhanced rule sets. Offers flexible deployment options to support either host-based or in-line solutions. Prevents information leaks and helps with compliance efforts through pre-packaged rule sets for commercial application vulnerabilities and for PCI standards. Delivers alerting, configuration and reporting capabilities in an easy to use remote console for event viewing and sensor configuration capabilities. Does not require the network reconfiguration for deployment. Protects the flow of mission-critical web traffic in the event of a power or hardware failure with its embedded bypass card. Learn More MODSECURITY MANAGEMENT APPLIANCE Essential Web Application Sensor Management The single source of essential web application security information. Provides current and historical web application security information from its centralized event database. Offers anytime, anywhere access to alerting and reporting capabilities through its intuitive, web-based interface. Presents a complete picture of web application security by supplying detailed event analysis. Saves time and deploys easily due to its innovative, self-contained application design that includes an embedded web server and database. Learn More

BREACHVIEW SSL SSL Traffic Decryption Decrypts SSL traffic, enabling complete analysis of encrypted traffic to find attacks Protects web applications from SSL attacks that go undetected by IDS/IPS's by delivering clean, decrypted traffic without obstructing the original transaction Reduces the latency in SSL traffic analysis by decrypting the SSL session without terminating, eliminating the need to re-encrypt traffic. Requires only one-time setup and configuration through an intuitive management interface. Available as a Microsoft® Windows® or Linux®-based software plug-in or pre-loaded on a hardened security appliance. Learn More

WHY WEB APPLICATION FIREWALLS ARE NECESSARY

Web Applications Are Increasingly Being Targeted by Hackers With nearly 70% of all new threats attempting to take advantage of flaws in web-based applications and web browsers, organizations need effective application security to ensure their sensitive information remains secure against attacks.1 However, internal pressure to deploy web applications quickly often outweighs thorough security testing, leaving vulnerabilities that are open to threats.

Targeted Application Attacks Are Missed by Network Security Solutions Network attacks are generic and designed to cause harm by affecting service levels or availability, but application attacks are targeted toward obtaining information from a specific application. Since each web application is unique, security must be tailored to the application to protect against these targeted attacks, something network security solutions cannot provide.

Secure Coding Initiatives Are a Recommended Best Practice, But Are Usually Unsuccessful Many organizations implement secure coding practices to protect their web applications, although few such projects are successful. Few developers have been trained in secure coding and security rarely receives the proper prioritization against deadlines.

Vulnerability Scanning Is Necessary, But Doesn’t Solve the Problem Application vulnerability scanning is a recommended for identifying and fixing defects in the development and quality assurance cycle; however, it only captures a snapshot of the web applications at a single point in time and frequently results in an overwhelming list of issues to be fixed. The expense of vulnerability scanning increases the overall project cost while finding the development resources with the time and expertise to fix issues can be difficult.

¹ Symantec, Inc., "Symantec Internet Security Threat Report," March 2007.