Re: [WEB SECURITY] thoughts on WAF deployment options?

["Ryan Barnett" <rcbarnett@xxxxxxxxx>]

------=_Part_6107_5116087.1208899302841
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

On Tue, Apr 22, 2008 at 4:58 PM, Arian J. Evans <arian.evans@anachronic.com>
wrote:

> > One correction - Breach's WebDefend is out of line (you had it in the
> >  inline transparent bridge group).
>
> Thanks.
>
> To clarify my post (correct me again if wrong): Mod runs inline proxy
> only, and WedDefend OoB. (I knew there was another OoB product
> I'd seen besides Imperva, but couldn't remember it)


We just completed a ModSecurity user survey so I actually have some info :)
Open source Mod users typically run it embedded, however using it in a
reverse proxy scenario is also popular.  Breach has a commercial appliance
called the M1100 that uses Mod as the base WAF-engine and it can be run in a
transparent bridge mode.



>
>
> To be clear -- I am not working with Breach WebDefend products.
> The *only* WAF I've worked wtih recently is F5, though I've worked
> with most of them on the market over the last 7 years.
>
> I *have* heard multiple positive things about WebDefend's technology
> from both technical peers at VARs, and several customers I work with.
>
> While second-hand info, they are opinions from smart folks, hence
> my recommendation to put that on the investigation list.
>
> btw// I hear a lot of *talk* about Modsecurity, but I don't know anyone
> who actually runs it (another topic of discussion).
>

Yeah, like most security related products, getting people to publicly state
what they are using is often a chore.  As I stated in my previous response,
there are many very large Mod deployments however we are under an NDA with
most of them.

------=_Part_6107_5116087.1208899302841
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

<div class="gmail_quote">On Tue, Apr 22, 2008 at 4:58 PM, Arian J. Evans &lt;<a href="mailto:arian.evans@anachronic.com";>arian.evans@anachronic.com</a>&gt; wrote:<br>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">
<div class="Ih2E3d">&gt; One correction - Breach&#39;s WebDefend is out of line (you had it in the<br>&gt; &nbsp;inline transparent bridge group).<br><br></div>Thanks.<br><br>To clarify my post (correct me again if wrong): Mod runs inline proxy<br>
only, and WedDefend OoB. (I knew there was another OoB product<br>I&#39;d seen besides Imperva, but couldn&#39;t remember it)</blockquote>
<div>&nbsp;</div>
<div>We just completed a ModSecurity user survey so I actually have some info :)&nbsp; Open source Mod users typically run it embedded, however using it in a reverse proxy scenario is also popular.&nbsp; Breach has a commercial appliance called the M1100 that uses Mod as the base WAF-engine and it can be run in a transparent bridge mode.</div>

<div>&nbsp;</div>
<div>&nbsp;</div>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid"><span id=""></span><br><br>To be clear -- I am not working with Breach WebDefend products.<br>The *only* WAF I&#39;ve worked wtih recently is F5, though I&#39;ve worked<br>
with most of them on the market over the last 7 years.<br><br>I *have* heard multiple positive things about WebDefend&#39;s technology<br>from both technical peers at VARs, and several customers I work with.<br><br>While second-hand info, they are opinions from smart folks, hence<br>
my recommendation to put that on the investigation list.<br><br>btw// I hear a lot of *talk* about Modsecurity, but I don&#39;t know anyone<br>who actually runs it (another topic of discussion).<br></blockquote>
<div>&nbsp;</div>
<div>Yeah, like most security related products, getting people to publicly state what they are using is often a chore.&nbsp; As I stated in my previous response, there are many very large Mod deployments however we are under an NDA with most of them.</div>

<div>&nbsp;</div></div>

------=_Part_6107_5116087.1208899302841--