Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

12/10/2007
05:05 AM
50%
50%

Beyond the PCI Band-Aid

Web application firewalls can help retailers pass their audits, but app firewalls aren't enough to secure customer data

Personal data is at risk in the retail environment, and consumers are justifiably worried. The TJX breach may have come as no surprise to the computer security industry, but the story continues to reverberate into the holiday shopping season. The TJX case was recently featured on 60 Minutes. According to the 60 Minutes report, retailers blame credit card companies for forcing them to store transaction data in case of a dispute (what?!). Credit card consortiums point the finger right back at retailers, claiming that storing and transmitting transaction data in a secure fashion is doable.

The Payment Card Industry (PCI) standards provide a low bar for data security in the retail environment. Nevertheless, many retailers are having trouble complying with the PCI Data Security Standard. Now politicians are getting involved, and vendors are coming out of the woodwork with magic solutions. (See PCI Costs, But Not as Much as a Data Breach.) The Web application firewall (WAF) has become a major player in the PCI space, but an app firewall won't even begin to solve the PCI problem.

Web application firewalls do their job by watching port 80 traffic as it interacts at the application layer using deep packet inspection. (See Review: Web Application Firewalls.) Security vendors hyperbolically claim that application firewalls completely solve the software security problem by blocking application-level attacks caused by bad software, but that’s just silly. Sure, application firewalls can stop easy-to-spot attacks like SQL injection or cross-site scripting as they whiz by on port 80, but they do so using simplistic matching algorithms that look for known attack patterns and anomalous input. They do nothing to fix the bad software that causes the vulnerability in the first place.

Nobody disputes the idea that data protection should be carried out as close as possible to where data are created, managed, and stored. Application firewalls are certainly getting closer to the right kind of solution by focusing on applications (at least when it comes to the Web) instead of other network traffic. However, a real solution requires solid software security for both Web apps and non-Web apps, combined with state of the art data security. (See Security Vendors Turn Toward Data Loss Prevention and Want Turns to Need.)

One thing application firewalls can do is stop the bleeding in tricky operational situations: That is, they can buy you some time. (See Wait for WAFs.) If a known breach is causing you to fail a PCI audit, for instance, installing an app firewall and stopping the set of known attacks the auditor is using will allow you to pass the audit.

This paradigm also works for real attacks as they unfold in the real world. If your software is under attack, and you know what the particular attack is, an app firewall can stop it cold. Still, the problem of bad software remains and is very likely to grow as more broken application code gets created. Smart security uses the time window provided by quick provisioning of an app firewall to fix the vulnerable software, and trains developers to do the right thing.

Meanwhile, consumers simply want their data protected. That means those retailers focused the spirit of PCI compliance – actually protecting customer data with better software security – rather than those just focused on the letter of PCI compliance (passing an audit with an app firewall), will win in the end. Customers demand no less.

— Gary McGraw is CTO of Cigital Inc. Special to Dark Reading

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
A Startup With NSA Roots Wants Silently Disarming Cyberattacks on the Wire to Become the Norm
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/11/2021
Edge-DRsplash-10-edge-articles
Cybersecurity: What Is Truly Essential?
Joshua Goldfarb, Director of Product Management at F5,  5/12/2021
Commentary
3 Cybersecurity Myths to Bust
Etay Maor, Sr. Director Security Strategy at Cato Networks,  5/11/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Google Maps is taking "interactive" to a whole new level!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-18194
PUBLISHED: 2021-05-17
Cross Site Scripting (XSS) in emlog v6.0.0 allows remote attackers to execute arbitrary code by adding a crafted script as a link to a new blog post.
CVE-2020-18195
PUBLISHED: 2021-05-17
Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete a specific article via the component " /admin.php?action=page."
CVE-2020-18198
PUBLISHED: 2021-05-17
Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete specific images via the component " /admin.php?action=images."
CVE-2020-21831
PUBLISHED: 2021-05-17
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_handles ../../src/decode.c:2637.
CVE-2020-21842
PUBLISHED: 2021-05-17
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_revhistory ../../src/decode.c:3051.