WebDefend 3.5 is the latest in Breach Security’s line up of security
appliances and brings new capabilities to the security market that
should have solution providers nicknaming the company “No-Breach”
security.
WebDefend 3.5 is a very good product that combines several elements
that make it very channel friendly and an appropriate device for
companies looking to protect their applications from intrusion, data
loss and meet the burdens of PCI, HIPAA, SOX and other compliance
requirements.
The name of the big game is data loss protection (DLP), a broad
concept that focuses on preventing data from falling into the hands of
unauthorized individuals. Thanks to Web-based applications, protecting
data and the integrity of associated applications has become more
complex than ever.
Some DLP vendors focus on encryption and end point control, while
others will look to the firewall to protect data. A select few will
offer DLP solutions based on hosted security services. While one can
argue which way is best, the end goal remains the same: protecting the
data without limiting access to valid users.
Breach Security follows a path that leads to an appliance-based
solution, WebDefend 3.5 is a security appliance that is designed to sit
at the edge of the network and actively protect applications and the
associated data from unauthorized access.
Solution providers may prefer Breach Security’s appliance approach;
after all it’s something tangible and can deliver an acceptable margin
on just that alone. Solution providers can also derive revenue from
implementation, monitoring, support and management–all service-related
elements that can add up to significant income, while providing
valuable service to customers with security concerns.
WebDefend 3.5 comes as a 1U appliance, which starts at a retail
price of $19,995. The device incorporates a multitude of security
features, including:
- SSL management
- Dynamic profiling
- Collaborative detection
- Behavioral analysis
- Rules and signature analysis
- Protocol violation
- Session protection
- Usage analysis
- Bi-directional exit control
- Application defect detection
- Correlation and analysis reporting
- Distributed detect/prevent architecture
While many of those are fancy terms for some rather pedestrian
security technologies, it’s still important to understand how each
contributes to the overall effectiveness of WebDefend 3.5. For example,
SSL decryption allows the device to look inside normally encrypted
traffic to check for intrusions or data leakage, an important
consideration since most Web applications use SSL by default. If you
can’t see what the traffic is, then how can you check to see if it is
legitimate?
The various security engines work together to validate traffic and
data by applying defined rules. Administrators can set rules to detect
various forms of data, ranging from something as esoteric as a social
security number to credit card information. Those rule definitions are
not only important for DLP, but also make the device an excellent tool
for meeting regulatory compliance.
In reality, a whole book could be written on the product’s features
(and Breach Security supplies one, it’s called the manual). The feature
mix is what determines where the product fits in the market and how
well it will meet the needs of the customer, and solution providers
should look at this feature set as an indicator of overall capability
and as a checklist for comparing the device to the other DLP players in
the market.
While the product offers many of the same features as competitors, it’s the unique features that help to set it apart.
WebDefend 3.5 offers multiple deployment options, one of which is
unique to the market segment–the device can be deployed out-of-line in
a networked Web environment and still block all detected attacks. Why
is that important? Simply because if the unit fails, it does not take
the network down with it and the unit will not introduce any latency
into the network with the out-of-line deployment scenario. Of course,
the unit can be deployed as an inline device and some administrators
will prefer that setup, knowing that all traffic will be sure to pass
through the unit. Either way, WebDefend 3.5 doesn’t require a
reconfiguration of the network.
When it comes to detection and remediation, WebDefend offers a
workflow style presentation of the information. That offers several
advantages to both security analysts and application developers by
allowing them to work together to further secure an application. The
way it works is by presenting the information from the initial
detection of a security event, through the investigation and analysis
in a simple to export report, all in a single step.
Most products on the market rely on a browser-based management
console for administrative chores, while WebDefend 3.5 uses a client
application installed on the administrator’s Windows PC. That approach
can complicate deployment and management, yet it will prove to be more
secure. What’s more, the client application offers a better interface,
performance and feature set than any Web-based client. That proves to
be important, when one considers the complexity of DLP and regulatory
compliance. Here, WebDefend’s management client offers fully integrated
help, a tabbed graphical interface, all with drill-down-able
information. That proves to be intuitive and will reduce training,
setup and maintenance hours.
Another element that simplifies deployment is the products ability
to “model” transactions. In other words, the device can learn what an
acceptable activity is and then use that to build access policies. For
many, that will prove to be a more efficient way to create access
policies. Most competitors on the market, take the “block everything”
approach where all access is shut down and then gradually opened based
upon predefined rules. That method can impact operations and delay
users’ access to critical applications. Without modeling, defining
those initial access rules can be a shot in the dark.
There’s a lot more than just validating user access when it comes to
protecting Web applications, the Web is full of individuals launching
scripted attacks, bots and other malicious software into an application
with the goal of gaining additional access, denying service or phishing
for proprietary data.
WebDefend 3.5 takes on that challenge by identifying attacks, such
as e-mail harvesting robots, comment evasion, file inclusion attacks,
insecure cookies and SQL injection variants. Those attacks are
identified using both signature files and by identifying abnormal
behavior.
While WebDefend 3.5 proves to be packaged well, offers excellent
capabilities and is easy to deploy, there are still several questions
solution providers will need to ask before settling on what Web
application firewall to deploy. Questions such as:
- How will the solution be integrated?
- Who will use it (security administrators, app developers, end users, etc.)?
- What complimentary solutions will be incorporated (end point protection, SSL, etc.)?
- Hosted, premise or a combination of solutions?
- Number of applications, users and locations supported?
- Which compliance requirements (PCI, HIPAA, SOX, etc.)?
- Scalability?
- Depth of reporting and analysis needed?
- Transparency to the network infrastructure?
Solution providers can apply these questions to Breach Security’s
WebDefend 3.5, as well as the company’s primary competitors, Imperva,
F5, Citrix, Barracuda and a few others. Most solution providers will
find that the true catalyst behind selling a Web application firewall
will come down to PCI compliance, which has fueled major interest in
the market. Beyond the Web application firewall deployment, there’s
some additional opportunity for the solution provider, especially those
with app development chops.
The real truth is that a Web application firewall’s primary function
is to protect poorly secured application code, which is often the root
cause of an application breach to begin with. Solution providers
managing those products can quickly delve into the remediation chores
of tightening up custom application code and further securing the
customer, while improving the ability to meet compliance requirements.
Web application firewalls still prove to be an excellent starting
point for delivering advanced security and it’s hard to beat what
Breach Security has accomplished with Web Defend 3.5.