Risk

12/10/2007
05:05 AM
50%
50%

Beyond the PCI Band-Aid

Web application firewalls can help retailers pass their audits, but app firewalls aren't enough to secure customer data

Personal data is at risk in the retail environment, and consumers are justifiably worried. The TJX breach may have come as no surprise to the computer security industry, but the story continues to reverberate into the holiday shopping season. The TJX case was recently featured on 60 Minutes. According to the 60 Minutes report, retailers blame credit card companies for forcing them to store transaction data in case of a dispute (what?!). Credit card consortiums point the finger right back at retailers, claiming that storing and transmitting transaction data in a secure fashion is doable.

The Payment Card Industry (PCI) standards provide a low bar for data security in the retail environment. Nevertheless, many retailers are having trouble complying with the PCI Data Security Standard. Now politicians are getting involved, and vendors are coming out of the woodwork with magic solutions. (See PCI Costs, But Not as Much as a Data Breach.) The Web application firewall (WAF) has become a major player in the PCI space, but an app firewall won't even begin to solve the PCI problem.

Web application firewalls do their job by watching port 80 traffic as it interacts at the application layer using deep packet inspection. (See Review: Web Application Firewalls.) Security vendors hyperbolically claim that application firewalls completely solve the software security problem by blocking application-level attacks caused by bad software, but that’s just silly. Sure, application firewalls can stop easy-to-spot attacks like SQL injection or cross-site scripting as they whiz by on port 80, but they do so using simplistic matching algorithms that look for known attack patterns and anomalous input. They do nothing to fix the bad software that causes the vulnerability in the first place.

Nobody disputes the idea that data protection should be carried out as close as possible to where data are created, managed, and stored. Application firewalls are certainly getting closer to the right kind of solution by focusing on applications (at least when it comes to the Web) instead of other network traffic. However, a real solution requires solid software security for both Web apps and non-Web apps, combined with state of the art data security. (See Security Vendors Turn Toward Data Loss Prevention and Want Turns to Need.)

One thing application firewalls can do is stop the bleeding in tricky operational situations: That is, they can buy you some time. (See Wait for WAFs.) If a known breach is causing you to fail a PCI audit, for instance, installing an app firewall and stopping the set of known attacks the auditor is using will allow you to pass the audit.

This paradigm also works for real attacks as they unfold in the real world. If your software is under attack, and you know what the particular attack is, an app firewall can stop it cold. Still, the problem of bad software remains and is very likely to grow as more broken application code gets created. Smart security uses the time window provided by quick provisioning of an app firewall to fix the vulnerable software, and trains developers to do the right thing.

Meanwhile, consumers simply want their data protected. That means those retailers focused the spirit of PCI compliance – actually protecting customer data with better software security – rather than those just focused on the letter of PCI compliance (passing an audit with an app firewall), will win in the end. Customers demand no less.

— Gary McGraw is CTO of Cigital Inc. Special to Dark Reading

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-9978
PUBLISHED: 2019-03-24
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.
CVE-2019-9977
PUBLISHED: 2019-03-24
The renderer process in the entertainment system on Tesla Model 3 vehicles mishandles JIT compilation, which allows attackers to trigger firmware code execution, and display a crafted message to vehicle occupants.
CVE-2019-9962
PUBLISHED: 2019-03-24
XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to VCRUNTIME140!memcpy.
CVE-2019-9963
PUBLISHED: 2019-03-24
XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to ntdll!RtlFreeHeap.
CVE-2019-9964
PUBLISHED: 2019-03-24
XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to ntdll!RtlpNtMakeTemporaryKey.