Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

12/10/2007
05:05 AM
50%
50%

Beyond the PCI Band-Aid

Web application firewalls can help retailers pass their audits, but app firewalls aren't enough to secure customer data

Personal data is at risk in the retail environment, and consumers are justifiably worried. The TJX breach may have come as no surprise to the computer security industry, but the story continues to reverberate into the holiday shopping season. The TJX case was recently featured on 60 Minutes. According to the 60 Minutes report, retailers blame credit card companies for forcing them to store transaction data in case of a dispute (what?!). Credit card consortiums point the finger right back at retailers, claiming that storing and transmitting transaction data in a secure fashion is doable.

The Payment Card Industry (PCI) standards provide a low bar for data security in the retail environment. Nevertheless, many retailers are having trouble complying with the PCI Data Security Standard. Now politicians are getting involved, and vendors are coming out of the woodwork with magic solutions. (See PCI Costs, But Not as Much as a Data Breach.) The Web application firewall (WAF) has become a major player in the PCI space, but an app firewall won't even begin to solve the PCI problem.

Web application firewalls do their job by watching port 80 traffic as it interacts at the application layer using deep packet inspection. (See Review: Web Application Firewalls.) Security vendors hyperbolically claim that application firewalls completely solve the software security problem by blocking application-level attacks caused by bad software, but that’s just silly. Sure, application firewalls can stop easy-to-spot attacks like SQL injection or cross-site scripting as they whiz by on port 80, but they do so using simplistic matching algorithms that look for known attack patterns and anomalous input. They do nothing to fix the bad software that causes the vulnerability in the first place.

Nobody disputes the idea that data protection should be carried out as close as possible to where data are created, managed, and stored. Application firewalls are certainly getting closer to the right kind of solution by focusing on applications (at least when it comes to the Web) instead of other network traffic. However, a real solution requires solid software security for both Web apps and non-Web apps, combined with state of the art data security. (See Security Vendors Turn Toward Data Loss Prevention and Want Turns to Need.)

One thing application firewalls can do is stop the bleeding in tricky operational situations: That is, they can buy you some time. (See Wait for WAFs.) If a known breach is causing you to fail a PCI audit, for instance, installing an app firewall and stopping the set of known attacks the auditor is using will allow you to pass the audit.

This paradigm also works for real attacks as they unfold in the real world. If your software is under attack, and you know what the particular attack is, an app firewall can stop it cold. Still, the problem of bad software remains and is very likely to grow as more broken application code gets created. Smart security uses the time window provided by quick provisioning of an app firewall to fix the vulnerable software, and trains developers to do the right thing.

Meanwhile, consumers simply want their data protected. That means those retailers focused the spirit of PCI compliance – actually protecting customer data with better software security – rather than those just focused on the letter of PCI compliance (passing an audit with an app firewall), will win in the end. Customers demand no less.

— Gary McGraw is CTO of Cigital Inc. Special to Dark Reading

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
A Realistic Threat Model for the Masses
Lysa Myers, Security Researcher, ESET,  10/9/2019
USB Drive Security Still Lags
Dark Reading Staff 10/9/2019
Virginia a Hot Spot For Cybersecurity Jobs
Jai Vijayan, Contributing Writer,  10/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17612
PUBLISHED: 2019-10-15
An issue was discovered in 74CMS v5.2.8. There is a SQL Injection generated by the _list method in the Common/Controller/BackendController.class.php file via the index.php?m=Admin&c=Ad&a=category sort parameter.
CVE-2019-17613
PUBLISHED: 2019-10-15
qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature to supply PHP code to be evaluated. Alternatively, the attacker can access admin/index.php?lfj=jfadmin&action=addjf via CSRF, as demonstrated by a payload in...
CVE-2019-17395
PUBLISHED: 2019-10-15
In the Rapid Gator application 0.7.1 for Android, the username and password are stored in the log during authentication, and may be available to attackers via logcat.
CVE-2019-17602
PUBLISHED: 2019-10-15
An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated.
CVE-2019-17394
PUBLISHED: 2019-10-15
In the Seesaw Parent and Family application 6.2.5 for Android, the username and password are stored in the log during authentication, and may be available to attackers via logcat.