[ news_security_news ]
Imperva Offers Stop Sign To Web Threats
David Utter
Staff Writer
2007-12-03
 Insider Reports RSS Feed
JavaScript highjacking and cross-site request forgeries threaten to make a mockery of modern Web 2.0 applications unless app providers do something to secure them.
The promise of software as a service promises to hit a granite block at high speed unless those who build applications do a better job of securing them, as Imperva CTO & co-founder Amichai Shulman told SecurityProNews. Many sites may be running applications that aren't as complete in their security approach as they could be.
To avoid the problems of JavaScript hijacks, courtesy of links embedded in an atttacker's page, and cross-site request forgeries that embed URLs to take action on behalf of the victim, Shulman advocated his company's gateway device approach.
By parking an Imperva device at the gateway, an enterprise can use it to distinguish legitimate requests from browsers, from those that are making invalid requests. Introducing a random parameter per session that an attacker can't know in advance makes it impossible for a third party to insinuate its way into the transaction path.
That's where the Imperva device enters the conversation. Rather than recoding an application to enable random parameters, the Imperva device doles them out as needed. It sits between the Internet and the application servers, checking for suspicious requests, and looks for a certain HTTP field match as requests return to retrieve more information.
If the additional data is not present or has been changed, the Impreva device asks for confirmation. In the case of a third party site requesting data, the individual will see that cross-site trying to grab data with the authentic user's permission, and the user should see the unauthorized third party doing this.
Imperva is taking a hardware approach to fixing the concerns driven by application software that could be open to an outside threat. As long as site responsiveness does not suffer from having Imperva in place, a purchase decision that presents better cost savings than recoding could make Imperva a security pro's choice for protecting users of its applications.
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
