Pundit - Guard the Application Layer
Once you’ve plugged the holes as best you can, it’s time to deploy a Web application firewall. These work in an interesting way: by learning what well-formed traffic to and from an application looks like and identifying the unexpected. To do this, Web app firewalls must inspect packets at a deeper level than do ordinary firewalls. Check Point is the best-known brand in this area, but the other vendors are relatively obscure: KaVaDo, NetContinuum, Sanctum and Teros. Some of these Web app firewalls are available as software, others as appliances, others as either. But don’t mistake this for plug and play, even in the case of the appliances. As with intrusion detection, you need to calibrate Web application firewalls carefully to reduce false positives without letting sneaky attacks through.
In the end, I wish such elaborate defense measures were unnecessary. Thanks to spam and ever more sophisticated attacks, it seems inevitable that the public Internet will devolve into overlapping virtual private networks. Meanwhile, we have no choice but to turn to increasingly clever gadgets to stave off the barbarian hoards.
