F5 and WhiteHat Integrate Web Application Assessment and Defense Technologies

Simple Identification And Remediation:
F5 and WhiteHat Integrate Web Application
Assessment and Defense Technologies
AbstractOn March 10, 2008, F5, a leader in application delivery, and WhiteHat Security, an innova-tor in application security assessment, announced they would be partnering to create an integrated Web application assessment and firewall technology. This product integration will incorporate WhiteHat's Sentinel assessment technology and F5's ASM attack blocking technology into a single solution. The partnership will allow customers to conduct both assessment and remediation of Web application vulnerabilities through a single manage-ment interface. This capability is in high demand as most enterprises are in dire need of not only accurate security assessments of their applications, but of more simple method-ologies for remediating vulnerability findings.
BackgroundWeb application security has moved to the forefront of many organizations' security strategies. Not only are Web applications a serious gateway for incidents that result in heavy costs to organizations, they are also the targets of new compliance standards. The Payment Card Industry Data Security Standard (PCI DSS) in particular is one of the most prescriptive security compliance measures that call for specific measures in Web application security. Unfortunately, PCI DSS requirements are flawed. PCI DSS gives or-ganizations the option of determining the best way to ensure application security through automated assessment or through the implementation of a Web application firewall. This is not an apples-to-apples comparison between technologies. In fact, the two technologies are more complementary than the either-or choice the PCI standard would suggest.Web application firewalls can put a measure of defense directly in-line in a readily deployable form factor-but without an assessment Unfortunately, attempts at technology, they may not be intelligent enough to remediate specific application risks as fully as possible. Conversely, Web assessment combining the strengths of technologies can be more accurate in identifying risks, but proper Web application assessment solutions typically require a great deal of resource delegation and time to implement, which can introduce significant costs as well as and Web application firewall delays in remediation exposures. Adoption of either of these two technologies have previously been technologies individually will leave a gap in the security posture of an organization and most likely create cost inefficiencies in strategies marred by major weaknesses trying to fill those gaps.in assessment engines. It is for these reasons that the integration of Web application firewalls and automated Web application assessment is so logical. Unfortunately, attempts at combining the strengths of Web applica-tion assessment and Web application firewall technologies have previously been marred by major weaknesses in assessment engines. False positives in particular have caused a great deal of headaches in these attempts at integration. These false positives fool integrated firewall technologies into believing serious flaws exist where they do not. This "miseduca-tion" often blocks necessary application functionality that may be critical to the business.
TEMA IMPACT BRIEF | Page  ©2008 Enterprise Management Associates, Inc. All Rights Reserved.Therefore, all the assessment findings must be verified before being implemented into a Web application firewall blocking methodology. Of course, this negates the cost efficien-cies of integrating the two technologies in the first place.
EventF5 has long driven towards the It is for these reasons that F5 and WhiteHat Security have partnered to create an effective integrated Web application firewall and assessment goal of enhancing application solution. Integrating assessment intelligence with Web application firewall intelligence through firewall technologies is important to creating effective security for dy-namic Web applications whose vulnerabilities are often as complex as efforts such as the recent release the functionality of the application itself. F5 has long driven towards of their iControl API and the goal of enhancing application firewall intelligence through efforts such as the recent release of their iControl API and the creation of the creation of community commu... [download for more]