AUSTIN, TX " April 13, 2009 " TippingPoint, a leader in intrusion prevention, today
announced availability of its Web Application Digital Vaccine (Web App DV) services, a
two-part approach to address the security threat posed by Web applications. This new set
of services enables TippingPoint customers to maximize their security investments, while
reducing the risk of attacks through custom-built Web applications. Further, the
deployment of the Web App DV service allows organizations to show Payment Card
Industry Data Security Standard (PCI DSS) compliance while avoiding the pitfalls
associated with the ambiguous protection offered by today's Web application firewalls.
Today's Web applications are used to support a variety of customer and partner
transactions and data exchanges, including inventory management and customer
relationship management (CRM). These applications often tie into sensitive data assets
such as credit card data or personal information. Prior to being "Webified," these
applications were set deep in the confines of the corporate network behind layers of
security. Now, these applications are being retrofitted to the Web in order to support a
larger audience of customers or partners and have moved closer to the perimeter of the
network.
"Companies invest a significant amount of money securing various layers of the
organization, including the operating system, the network " even the endpoint. However,
Web applications " while productive " are still the Achilles heels of most
infrastructures," said Rob Ayoub, global program director for network security at Frost &
Sullivan. "Since the components of these applications were not originally designed to
work together, there are oftentimes weak points associated with the way these are
connected. These weak spots represent a greenfield of opportunity for hackers looking to
access sensitive data deep in the network."
Improving Web Application Protection with Intrusion Prevention
Customer feedback indicates that Web application firewalls (WAFs) have had issues with
false positives when deployed in-line with the network. Instead of ensuring high
availability of the Web applications they were assigned to protect, the firewalls are
causing network outages and performance problems. In addition, the constant tuning
required to mitigate these false positives adds unnecessary ambiguity to the
vulnerabilities the WAFs will ultimately protect against and creates a drain on IT
resources and budget.
With the TippingPoint Web App DV services, vulnerabilities in customers' custom-built
Web applications are identified and remediated with a set of custom DV filters working
in tandem with the standard DV filters to provide comprehensive network protection. The
service begins with a scan of the application and associated URLs to determine weak
points in the code and possible areas that could be exploited by malicious attacks such as
SQL injection, cross-site scripting or reverse proxy. Once the scan is completed, the
customer works with TippingPoint's DVLabs team to categorize the vulnerabilities by
severity and create a custom filter or set of filters that will be deployed through the
TippingPoint IPS.
"TippingPoint's Web App DV services extend the power of the IPS to capture attacks
threatening previously unseen security vulnerabilities," said Rohit Dhamankar, director
of TippingPoint's DVLabs. "Adding custom filters to the standard filters already included
in the TippingPoint IPS provides our customers with another layer of protection for their
corporate assets."
Improved PCI Compliance Through Documented Web Application Protection
It is now mandatory in the PCI DSS standard for every organization to provide proof that
its Web-based applications are protected from malicious attacks. TippingPoint's Web
App DV services not only scan these Web applications for dangerous vulnerabilities, but
also create custom filter sets that protect the organization's critical assets and meet the
standard for PCI compliance. Additionally, as part of the follow-up scan, the protection
from these filters is documented in a PCI report, providing clear validation that the
identified vulnerabilities have been mitigated.
Availability and Pricing
The TippingPoint Web App DV Services will be available to customers in May 2009.
Customers have the option of utilizing their legacy Web application scanning programs
or TippingPoint's Web application scanning service. The TippingPoint Web application
scanning service will be offered at a fixed price and will include the initial scan as well as
a post-filter scan to ensure accurate blocking. Custom filters will be priced according to
volume ordered and will be delivered to the customer within 48-72 hours following the
application scan.
For more information on the TippingPoint Web App DV Services, visit
www.tippingpoint.com/webappdv.
About TippingPoint
TippingPoint is a leading global provider of comprehensive network security solutions
that address the security and regulatory compliance needs of complex network
environments for enterprises, government agencies, service providers and academic
institutions. With the TippingPoint IPS-Secured Network, which includes the
TippingPoint' Intrusion Prevention System (IPS) and Network Access Control (NAC)
solution, network infrastructure, applications, and critical data are protected from
malicious cyber attacks. TippingPoint's 360° approach to network security enables
enterprises to enforce security policies across all users, devices, traffic flows and content;
while preserving existing infrastructure and ensuring business continuity to help lower
total cost of ownership. TippingPoint's security intelligence is powered by DVLabs,
TippingPoint's premier team of expert internal researchers for vulnerability analysis and
discovery. DVLabs is supplemented by over 900 external Zero Day Initiative researchers.
For more information, please visit www.tippingpoint.com, or the press center at
http://www.tippingpoint.com/press.
About 3Com Corporation
3Com Corporation (Nasdaq: COMS) is a $1.3B global converged network infrastructure
supplier that helps customers achieve business success by delivering solutions that
provide exceptional value. The company's H3C enterprise networking portfolio provides
best-in-class performance, efficiency and reliability and delivers unparalleled return on
investment. Through its TippingPoint division, 3Com is a leading provider of networkbased
intrusion prevention systems that deliver in-depth application protection,
infrastructure protection, and performance protection. For further information, please
visit www.3com.com, or the press site www.3com.com/pressbox.
