Take the 2-minute tour ×

What is the best Web Application Firewall(WAF) for IIS? What makes it better than the others? How useful is it at blocking attacks against poorly written code, otherwise known as an Intrusion Prevention System (IPS)?

WAFs are required by the PCI-DSS, so if I have to get one, then it should the best one.

share|improve this question

closed as off topic by sysadmin1138 May 1 '12 at 19:11


If you think a firewall will protect you from attacks against poorly written code you have some interesting days ahead of you. :) –  John Gardeniers Jan 27 '10 at 9:58
Can you indicate where in the PCI documentation it indicates that a WAF is required? I'm not convinced this is true, without a reference. –  Cheekysoft Jan 27 '10 at 12:35
@Cheekysoft, your right, it does however require an IPS or IDS and HTTP/HTTPS is the only thing open on the server. –  Rook Jan 28 '10 at 8:06
Please note that in new regulations provided to ASVs from the PCI security council this month, detection of an IPS/IDS that affects the results of the scan is an instant PCI fail. So ensure that you choose one that allows you to whitelist your ASV's source addresses. –  Cheekysoft Feb 2 '10 at 10:15
Product and service recommendations, including 'best' research, are off topic per the updated FAQ. –  sysadmin1138 May 1 '12 at 19:12
add comment

8 Answers

up vote 3 down vote accepted

That is an extremely open ended question. A firewall can be software or hardware, free or tens of thousands of dollars. It really depends on your needs and budget as far as "best".

Of course, in the end, when you say "best", I say: Cisco.

Note that the term "web application firewall" also means different things to different people. To Cisco, it seems to mean an xml-targeted system. You may actually need a more general purpose firewall like something from the ASA series. These issues of security are multifaceted, and I'm not a PCI-DSS expert, so I'm not completely sure of the nuances with your request. However, I can tell you that whatever you need, Cisco has it, and it probably rocks, if you'll forgive the superlative.

share|improve this answer
add comment

First of all, I'm not sure where you doubters have been for the last few years, but the requirement for a WAF in PCI is one part of requirement 6.6, and it's been the most talked about requirement of the last few years. (I would post a link, but since I'm new I can only post one link per message, and I'm saving it. Just google "6.6 PCI WAF" and you'll have a thousand results).

As for which is "best", best is a very relative term. Try to find the one that best fits your needs and budget. If you want a starting point, there's a brief writeup of the major players here: http://www.docstoc.com/docs/9687629/WAF

share|improve this answer
add comment

I have tested a number of different Web Application Firewalls from many the major hardware and software vendors. None of them have really had any noteable affect on my ability to manually expose the problems in vulnerable web applications.

They are getting pretty good at stopping the kind of attacks that worms, or unseasoned attackers may try, but a determined human attacker can always easily tweak his attack vector such that it no longer trips the IDS. They all essentially match requests against regular expressions, looking for common attack patterns. But they are so easy to get around.

Only consider a device like this as an additional layer to your security. Do not consider one to save your developers from writing vulnerability-free code, or save your admins from keeping systems and software regularly updated and patched. I can tell you for free that they won't stop people getting at your SQL injection or cross-site scripting vulnerabilities.

share|improve this answer
Writing vulnerability free code is impossible. So then would it also be true that you should put up as many obstacles as possible. –  Rook Jan 28 '10 at 8:02
@Cheekysoft, your right, the pci-dss does however require an IPS or IDS and HTTP/HTTPS is the only thing open on the server. –  Rook Jan 28 '10 at 8:07
Agreed with anonymous; Non-vulnerable code doesn't really exist and a layered approach to security is a great idea. It is also always important to understand what each layer achieves. –  Cheekysoft Jan 28 '10 at 10:34
add comment

I'm with Cheekysoft, but I'd also regularly scan my Web applications for vulnerabilities with Nessus, Nikto, and (haven't tried yet but heard good things) with Google's recently released SkipFish. You may also be able to make your own informed decision from The Open Web Application Security Project (OWASP) guide to Web Application Firewalls: http://www.owasp.org/index.php/Category:OWASP_Best_Practices:_Use_of_Web_Application_Firewalls

share|improve this answer
add comment

I have tried several top of the line WAFs. Some come built-in with load balancers (think F5, Zeus). Others are dedicated, stand-alone WAFs. Tested numerous ones by actually running AppScan against known vulnerable web code. The top performer for me was Imperva's SecureSphere WAF. You're going to pay through the nose for it, but in terms of raw security, logging, and customizability, it's currently the best. You can get it virtual or physical appliance, each with their advantages. They have very strict licensing, and are pricey, but their logging capabilities and their signature updates are hard to beat.

We also code test the applications themselves using AppScan and WebInspect both. As has been mentioned, doing WAF + code review is best because you can't get 100% with either method alone. This is very different than IDS/IPS systems which is looking mostly at layer3 traffic, not at layer7 where most attacks are successful nowadays. There are also cloud-based WAF protections (security as a service) which offer the same protection but for much less investment.

share|improve this answer
add comment

Larry Suto recently did an analysis of WAFs which you might find interesting. I have no connection to him, but Imperva did well. http://www.manvswebapp.com/wp-content/uploads/Analyzing_Effectiveness_of_Web_Application_Firewalls.pdf

For some balance, Ofer Shezaf, who was at Breach Security for several years and has been a contributor to the open source ModSecurity has some concerns about Larry's methodology, i.e. lack of testing WAF's ability to detect evasion techniques http://www.xiom.com/2011/11/17/larry_suto_strikes_again

I have no connection to Ofer Shezaf either.

Full disclosure - My company is an information security solution provider and we selected Imperva's SecureSphere. Imperva also offers a cloud-based WAF that's not as functionally rich as SecureSphere, but faster to deploy and easier to administer.

share|improve this answer
add comment

For IIS consider Microsoft Threat Management Gateway (was ISA server). It is geared towards IIS and it is one of only three firewalls that have EAL4 + rated (the other two being ASA/PIX and Checkpoint). You can either install it on your own commodity hardware, or buy it as an appliance such as made by Celestix.

share|improve this answer
add comment

At the end of the day I am shakey on if webknight is legit for the long haul or not. But in all honesty their app kicks most of the paid apps I have worked with in the butt.

I am not paying 13 trizzilion dollars for an isapi extension, many people seem glad to pay this.

We need to rally on the webknight dude and help update his software if he needs it. Too bad he doesn't publish on codeplex or somewhere where we can help easily.

share|improve this answer
add comment
