firewalls

Hi Larry,

One of the critical points you mentioned is that your are deciding the firewall configuration for your company's web application. In your situation, we would suggest a properly configured hardware firewall as well as a product like Covelight Systems' Percept appliance. The reasoning for this is that a typical firewall setup for a web application is going to allow all packets destined for the web application through, leading to the classic "port 80 dilemma", which is to say that you are still vulnerable to Application Attacks even if you are fairly well protected from Network Attacks. Percept will allow you to monitor and audit web application usage to prevent any number of potentially devastating web application breaches.

A great site for studying about web application security is

------------------------------------------------------------- Covelight Systems

Protecting the privacy, integrity and confidentiality of your critical web-enabled information.

Always a bad idea.

This is the proper method, and the webserver should not be part of your trusted network.

This is almost the same as the Hardware firewall - and most people call the #2 item an "Appliance". Many firewalls that protect corporate environments are #2 and #3, there is no real difference in function, only the number of parts that could fail.

The "Personal" firewall applications are not designed for a server that faces the public, if they are even designed for a server at all. Any server that is exposed to the public should not rely on a firewall application installed on the same server, it's just a bad idea, and it's easy to compromise the firewall if the server services are compromised.

CheckPoint is the only firewall I would run on a computer acting as a Firewall server.

WatchGuard is the firewall Appliance of my choice for stand alone units.

It is always better to have the firewall SEPARATE from the server. After all if the server gets hacked the firewall is useless.

Good call.

This is really the same a a "firewall" in between the outside and the server...

I would do to this:

2) Get a Stand alone firewall, I like the Cisco PIX, but even a linux/FreeBSD box would be a get solution.

Now, first this might be a lot of hardware for you company. I do not know how small or large you are. However, placing a layer 4 firewall in front of your layer 7 firewall is a generally good idea since layer 4 firewalls can take much more of a beatting than a layer 7. If you are a small company, I would use Linux/FreeBSD for you layer 4 firewall. The firewalls that come on Linux/FreeBSD are quite good (not to meantion free!)

To summarize coming from the Internet to your server: || Internet Router with ACLs (just anti spoofing and RFC 1918 subnet stuff) || Layer 4 firewall (linux or Cisco PIX) || DMZ Layer 7 firewall (You servers connect to this firewall) || Your internal network

Michael

A good layer 7 firewall is made by sidewinder. Their web page is:

This is the only choice I would choose. If you have some budget, you should think of a decent hardware firewall. You do not have to pay a lot of money for it.

William Sun