1. www..com WAFs in the Cloud A new direction for WAFs? Ofer Shezaf January 2010

2. www..com What is a WAF?

3. www..com The two faces of information security: Attack Detection: Anti-Virus Anti-Malware IDS/IPS Policy Enforcement: Firewall NAC Scanners

4. www..com Which one is a WAF? It’s a firewall isn’t it? So it must be a policy enforcer. But it does signatures, so it is probably an attack detector.

5. www..com Depends

6. www..com The XIOM Definition Intimate understanding of HTTP A positive security model Application layer rules Session based protection Fine grained policy management

7. www..com What is a cloud?

8. www..com This is a cloud

9. www..com More Seriously SaaS: SalesForce PaaS: Shared Hosting PaaS: Shared Hosting IaaS: Amazon EC2

10. www..com What Role Can a WAF Play in the Cloud?

11. www..com The Menu Enterprise Security Gateway WAF as a service –For protecting a data center –For protecting SaaS WAF for a cloud deployment –Host Based –Infrastructure Based WAF stubs –For a data center –For a cloud deployment

12. www..com Enterprise Security Gateway

13. www..com Enterprise Security Gateway Protect in the cloud services through unified security gateway. Pros: Unified access control Security for 3 rd party code Cons: Double bandwidth Hard to create positive security rules

14. www..com WAF as a Service For SaaS For a Data Center

15. www..com WAF as a service Use an in the cloud WAF to protect enterprise data center. Pros: Very easy deployment. Fast signature updates. Might be the only solution for a SaaS Cons: Double bandwidth Preventing direct access

16. www..com WAF as a service - Akamai Applies ModSecurity Core Rules to HTTP traffic. Uses Akamai internal HTTP processing technology Signatures only, hardly a WAF

17. www..com WAF for Cloud Environment

18. www..com WAF for Cloud Environment Use an in the cloud WAF to protect enterprise data center. Pros: No Bandwidth Overhead Cons: Might be harder to deploy

19. www..com Host based WAF

20. www..com Host based WAF The most mature approach to WAF in the cloud. ModSecurity, SecureIIS, Applicure, PHPIDS…. However many times not more than an Host based IPS.

21. www..com WAF stubs

22. www..com WAF Stubs Host based stub and a remote brain. Different separation levels: –Remote monitoring & configuration –Remote learning –Remote enforcement –In-between.

23. www..com WAF Stubs Art of Defence stub for AWS Breach Global Event Manager –Monitoring Only

24. www..com Thank You! shezaf@xiom.com