Protecting Applications Across Multiple Clouds

With cloud-based applications come new security risks that require expertise that is typically scarce and that can delay application deployment and maintenance.

While WAFs play a critical role in protecting applications, deploying and managing a WAF can be complex and require ongoing refinement of security policies. Managing these policies often requires expertise and intimate familiarity with any WAF solution. In addition, it is not always possible to leverage the same WAF across heterogenous cloud environments, thereby limiting the ability to enforce security policies across environments.

DevOps typically automates application integration and deployment cycles (CI/CD) to accelerate the process of deploying new applications. To accomplish this, they will often integrate with solutions that facilitate integration and speed. Security solutions, which are typically complex, are not prioritized due to this reason, leaving applications unprotected.

Monitoring security events across applications is another challenge because there is no central dashboard across disparate cloud computing environments. It also requires security expertise to understand which security policy updates need to be implemented based on the aforementioned reporting information.

[You may also like: From Survival to Security and Availability]

What to Look For

When evaluating a solution, look for the highest level of application protection while minimizing false positives and maintenance, and the ability to run across multiple private and public cloud environments. Further, consider if the solution offers the following:

• Full Coverage of OWASP Top-10 including injections, cross-site scripting (XSS), cross-site request forgery, broken authentication and session management and security misconfiguration.
• Reduced TCO with lowest false positives through unique auto-policy generation technology designed to secure a web application automatically.
• Protection from Zero-Day Web Attacks using both negative (signature based) and positive security models that ensure the lowest false positives and minimal operational effort, but also robust protection against known and unknown (zero-day) threats.

[You may also like: Application Security in Today’s Multi-Cloud World]

• Device fingerprinting for bot protection. The power of the fingerprint is in the consolidated information extracted from dozens of browser attributes collected on the client side, facilitating accurate bot classification.
• Actionable reporting. For example, Radware’s Alteon Multi Cloud provides a monitoring and reporting tool that makes it easy to monitor application protection events and actions, the attacks it identifies, and any blocked transactions.
• Scalability. A WAF is a resource-intensive function. Allocating WAF resources to match peak application usage periods can be costly when operating in a cloud environment.

Deploying a firewall does not have to be a complex, resource-intensive process. Choosing a solution with the ability to span multiple cloud environments and automatically scale WAF services to match application usage levels will allow organizations to seamlessly deploy application security policies without extensive expertise.