There is a long-running tradition in the web application
firewall space; every year we say: "This year is going to be the one when
web application firewalls take off!" So far, every year turned out to be a
bit of a disappointment in this respect. This year feels different, and I am
not saying this because it's a tradition to do so. Recent months have seen a steady
and significant rise in the interest in and the recognition of web application
firewalls. But why is it taking so long?
Having been involved with the industry for many years, I
come up with many valid theories to explain the apparent slow adoption of
web application firewalls. Here are some of them:
- It's a brand new type of product that requires effort to learn how to use. Articles, books and papers need to be written, conference talks need to be scheduled and best practices need to be established. We need a critical mass of people with access to the technology in order for discussions to take place and for users to start to be comfortable.
- Network security people are the likely ones to be tasked to deal with application security. To deploy a WAF one needs at least a minimal understanding of application security, but to achieve this, in a field where attacks are still evolving at a rapid pace, is not easy.
- Many organisations are yet to assign people to deal with application security full-time,
let alone web application firewalls.
- It is often not clear who is supposed to manage the technology. Does it fall under network security or application development? Or should we assign it to the application security team instead (where it exists)? This decision is made more difficult by the fact that some web application firewalls can be deployed inline (e.g. as a bridge or a reverse proxy), where they impact performance (not necessarily in a negative way) and create a point of failure.
Above all, the perception seems to have been that web
application firewalls are not something we cannot live without. At the same time,
the opposite is true for network firewalls. This has to do with the differences
in risk distribution in network security and application
security. In the network application space virtually all organisations run
off-the-shelf products on their servers. Once vulnerabilities in these products
are exposed exploits are written. These exploits are easy to deploy in an
automated and indiscriminate manner, and this sort of thing is happening on a
massive scale. The likelihood of being hit by such an exploit is very high,
although the damage coming from such an attack might not be. When you add to
this the fact workstations (whose numbers by far outweigh those of the servers)
are also targets, it becomes clear why firewalls are viewed as
essential.
In the application security world most attacks are still
carried out by hand. One reason for this is that people haven't started
automating the attacks yet (but this is changing, as demonstrated by recent automated
SQL Injection attacks); the other that most web applications, unlike network
security products, are custom-developed and thus require manual exploitation. The
net result is that some organisations are hit by application security problems
and some others aren't, although most are equally insecure. Lack of mass-scale
exploitation is contributing to the feeling there is still more time to act.
This, of course, is an illusion. Organisations without web
application firewalls are playing a game not unlike that of Russian roulette,
hoping they won't be affected. But in this game you get hit—eventually. It's just
a matter of time. We are seeing the increased interest now because people are
starting to get fed up with web application security issues appearing left and
right. Every new day sees a new type of problem discovered. Every day we hear
of a new massive attack with damages running into millions. (The Web Hacking Incidents Database project is particularly good at documenting these.) People are waking
up to the fact that addressing their problems before attacks take place is
going to be much less painful (and far less costly) than doing the same afterwards.
In other words, and to simplify greatly, we haven't seen
mass adoption of web application firewalls so far because that market was too
young. The time was not right. But it will be right this year. I think.
