Almost every modern enterprise uses hundreds of Web, mobile or ERP applications to help run their operations. But as your number of applications grows, so does the number of security vulnerabilities within them that could be exploited to damage your business. The Verizon 2014 Data Breach Investigation Report (DBIR) shows that last year 35% of security breaches involved attacks against web applications, up by 14% since 2012. Moreover, Web app attacks were the most common cause of data breaches, followed by cyber-espionage, POS intrusion and insider misuse.
Why do these attackers succeed? The fact is that most application security threats are created by developers’ mistakes that cannot be addressed with traditional security scanners, IDS/IPS or firewalls:
Web Application Firewall (WAF), a smart protection system is a serious response to the security challenges created by today’s range of web portals, ERP and mobile applications. WAF can block 30% more network attacks than other firewalls thanks to several innovative security technologies:
The primary WAF benefit is providing protection for custom Web applications' "self-inflicted" vulnerabilities in Web application code developed by the enterprise. These vulnerabilities would otherwise go unprotected by other technologies that guard only against known exploits and prevent vulnerabilities in off the shelf Web application software.
Secondarily, WAFs also integrate with other application and network security technology, such as application security testing (AST), distributed denial of service (DDoS) protection appliances, Web fraud detection and database security solutions. In addition, WAFs sometimes include performance acceleration, including content caching, and might be packaged with Web access management (WAM) modules to include authentication features — notably to provide single sign-on (SSO) for legacy or distributed Web applications.
Positive Technologies is a pioneer of the IT security industry, and has shipped its WAF, called PT Application Firewall, since 2013. Positive Technologies shipped its first WAF central management platform and introduced clustering capability in 2014. The vendor also has MaxPatrol (a vulnerability scanner that can look for general network vulnerabilities and SAP and ICS/SCADA vulnerabilities) and PT Application Inspector, which combines static, dynamic and interactive code analysis techniques. Positive Technologies' WAF product is currently available as a dedicated appliance, as a software version that can run on a third party appliance and as a virtual machine that is predominantly installed on the enterprise's premises; It can also be delivered as a managed security service through carrier partners. Its customers are distributed relatively evenly among the SMB, enterprise and large enterprise segments. Most of its customers are governmental agencies and financial institutions.
With more than 10 years of security research and a huge knowledge base of vulnerabilities, the experts at Positive Technologies have amassed extensive experience in protecting enterprises of all sizes across a wide range of industries. Each industry has its own unique features and requirements are crucial to practical security. Every deployment of PT Application Firewall includes configuration to meet the specific needs of each client.
Positive Technologies is rated as a Visionary because of its unique, leading edge security features. Organizations that are looking for high security first should consider adding Positive Technologies to their shortlists, but verify the level of local expertise on and support for the technology.