What web application firewall do you use? What should I use?

Question

What web application firewall do you use? I'm primarily interested in something I can deploy on the perimeter that can protect multiple Apache and IIS servers, but I'd like to hear all answers. Tell me a little bit about how many servers it protects, what kind of load, performance, price. Basically anything you want to share.

Answer 1

Having said I have no experience in using Mod Security, I like to share the following review:

ModSecurity is an open source web application firewall (WAF) engine for Apache that is developed by Trustwave's SpiderLabs. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis. With over 10,000 deployments world-wide, ModSecurity is the most widely deployed WAF in existence.

It operates embedded into the web server, acting as a powerful umbrella – shielding applications from attacks. ModSecurity supports both branches of the Apache web server.

The module filters, and optionally rejects, incoming requests based on a number of different criteria like CGI variables, HTTP headers, environment variables, and even individual script parameters. mod_security can also create an audit log, storing full request details in a separate file, including POST payloads (the audit feature can be turned on or off on a per-server or per-directory basis).

Advantage

The advantage of mod_security is “security”.

1. No network side configuration
2. Easy management.
3. Free as in Beer
4. HTTP intrusion detection and prevention

Disadvantages

1. You have to become a security expert
2. You have to become a protocol expert.
3. The configuration must be done manually.
4. Performance degradation