Adding Web Application Firewalls to your Security Strategy

The volume of application traffic passing through our networks continues to escalate. For example, just mobile traffic alone is expected to grow 39 times by 2021, to about 587 Exabytes. That equates to roughly 130 trillion images, or about 13 trillion YouTube clips. Which doesn’t really help. Numbers at that scale are simply impossible to imagine.

What you can imagine, is that web application traffic continues to be a primary conduit for malware and cybercriminals to infiltrate networks, corrupt systems, and steal data.

Web Application Firewalls (WAFs) are designed to inspect and protect HTTP connections and prevent web-based attacks such as cross-site scripting (XSS) and SQL injection. While WAF tools and devices have been around for over a decade, and are a required technology for organizations that process credit card transactions (PCI-DSS), they are just now starting to gain traction in many networks.

Gartner’s Magic Quadrant for Web Application Firewalls

Which is why we are pleased to announce that our FortiWeb appliance has once again placed in the “Challenger” quadrant in Gartner’s recent Magic Quadrant for Web Application Firewalls 2017 report, as well as improving our position up and to the right over 2016. 

Making FortiWeb Part of Your Larger Security Strategy

The challenge, of course, is that web application traffic – and the security that monitors that traffic – doesn’t exist in a vacuum. Application traffic is simply a set of commands or data moving from one device or application to another. In the bigger picture, it is a part of an elaborate transaction set that includes endpoint devices, data centers, and web application servers. Traffic moves from user or IoT endpoints, across the perimeter, into the core of the network, and even out to the cloud.

Which means that while WAF security solutions are important, they cannot afford to operate in isolation. Instead, they need to be integrated into a broader security strategy. Which is why FortiWeb’s development team not only focuses on improving overall performance and security effectiveness, but also on implementing new integration elements as well, designed to make it an even more integral component of the Fortinet Security Fabric. As part of the Security Fabric, FortiWeb is able to provide critical threat intelligence to the network, correlate data collected from across the networked environment, and actively participate in a coordinated and automated response to detected threats. This is something that no other WAF vendor is able to provide.

FortiWeb’s integrated performance and value helped it earn the coveted “Recommend” rating from NSS Labs, which means that every Fortinet solution that is part of the Fortinet Security Fabric has now received top reviews. And we are the only integrated security solution vendor to achieve this recognition.

An Aggressive Development Strategy

But this is just the beginning. We are hard at work on advancing our security portfolio to  build deeper cross-integration between devices, expand our cloud-based solutions, and enhance our auto learning engines to better combine machine learning, deep learning, and AI algorithms with global and real-time local threat intelligence.

We are also committed to the continued expansion of distribution and training resources for our partners, including engineering resources to assist channel partners during the pre- and post-sales of FortiWeb products.

FortiWeb also offers an automated and regularly updated attack signature feed, driven by our FortiGuard Labs threat research team. Our recent introduction of syntax-based detection for SQL injection detection, for example, has significantly improved FortiWeb’s detection efficiency and virtually eliminated false positives for these types of attacks.

Conclusion

As web application traffic continues to escalate, and as networks and devices become increasingly interconnected, it is critical that organizations not only deploy an effective WAF solution, but one that can become a critical and intelligent component of an integrated security fabric. Such an “expert system” needs to be capable of connecting security and network devices together and then applying intelligence to actionable information passed between these devices, even across different network segments and ecosystems.

Gartner Magic Quadrant for Web Application Firewalls, Jeremy D’Hoinne, Adam Hills, Claudio Neiva,  07 August 2017

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.