05:05 AM

Beyond the PCI Band-Aid

Web application firewalls can help retailers pass their audits, but app firewalls aren't enough to secure customer data

Personal data is at risk in the retail environment, and consumers are justifiably worried. The TJX breach may have come as no surprise to the computer security industry, but the story continues to reverberate into the holiday shopping season. The TJX case was recently featured on 60 Minutes. According to the 60 Minutes report, retailers blame credit card companies for forcing them to store transaction data in case of a dispute (what?!). Credit card consortiums point the finger right back at retailers, claiming that storing and transmitting transaction data in a secure fashion is doable.

The Payment Card Industry (PCI) standards provide a low bar for data security in the retail environment. Nevertheless, many retailers are having trouble complying with the PCI Data Security Standard. Now politicians are getting involved, and vendors are coming out of the woodwork with magic solutions. (See PCI Costs, But Not as Much as a Data Breach.) The Web application firewall (WAF) has become a major player in the PCI space, but an app firewall won't even begin to solve the PCI problem.

Web application firewalls do their job by watching port 80 traffic as it interacts at the application layer using deep packet inspection. (See Review: Web Application Firewalls.) Security vendors hyperbolically claim that application firewalls completely solve the software security problem by blocking application-level attacks caused by bad software, but that’s just silly. Sure, application firewalls can stop easy-to-spot attacks like SQL injection or cross-site scripting as they whiz by on port 80, but they do so using simplistic matching algorithms that look for known attack patterns and anomalous input. They do nothing to fix the bad software that causes the vulnerability in the first place.

Nobody disputes the idea that data protection should be carried out as close as possible to where data are created, managed, and stored. Application firewalls are certainly getting closer to the right kind of solution by focusing on applications (at least when it comes to the Web) instead of other network traffic. However, a real solution requires solid software security for both Web apps and non-Web apps, combined with state of the art data security. (See Security Vendors Turn Toward Data Loss Prevention and Want Turns to Need.)

One thing application firewalls can do is stop the bleeding in tricky operational situations: That is, they can buy you some time. (See Wait for WAFs.) If a known breach is causing you to fail a PCI audit, for instance, installing an app firewall and stopping the set of known attacks the auditor is using will allow you to pass the audit.

This paradigm also works for real attacks as they unfold in the real world. If your software is under attack, and you know what the particular attack is, an app firewall can stop it cold. Still, the problem of bad software remains and is very likely to grow as more broken application code gets created. Smart security uses the time window provided by quick provisioning of an app firewall to fix the vulnerable software, and trains developers to do the right thing.

Meanwhile, consumers simply want their data protected. That means those retailers focused the spirit of PCI compliance – actually protecting customer data with better software security – rather than those just focused on the letter of PCI compliance (passing an audit with an app firewall), will win in the end. Customers demand no less.

— Gary McGraw is CTO of Cigital Inc. Special to Dark Reading

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Who Does What in Cybersecurity at the C-Level
Steve Zurier, Freelance Writer,  3/16/2018
Disappearing Act: Dark Reading Caption Contest Winners
Marilyn Cohodas, Community Editor, Dark Reading,  3/12/2018
Microsoft Report Details Different Forms of Cryptominers
Kelly Sheridan, Staff Editor, Dark Reading,  3/13/2018
Register for Dark Reading Newsletters
White Papers
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.