IBM SoftwareIBM Security Solutions

Solution Brief

Web application securitywith IBM SecuritySolutionsEnhance your IT security investment with robustweb application protection

Highlights● Designed to deliver the full protection

of a web application firewall throughnetwork and server intrusion preventionsolutions

● Offers proactive web application, Web 2.0 and database protection tolimit potential business interruptionsand exposures

● Integrates with IBM Rational®AppScan® to automatically generaterecommended security policies for yourspecific web application vulnerabilitiesidentified by AppScan

● Helps meet regulatory compliancerequirements and industry standards,including PCI DSS

Fortifying your IT security solution withprotection for web applicationsWeb applications can help foster closer interactions with your cus-tomers and improve collaboration with your employees. During thepast several years, however, the number of web-related threats toenterprises of nearly all sizes has risen sharply. About half of theseattacks targeted web applications. Even more alarming, by year-end2009, two-thirds of all disclosed web application vulnerabilities had nopatch available. Two significant areas of vulnerability, Structured QueryLanguage (SQL) injection attacks and Cross Site Scripting (XSS)attacks, dominated the attack landscape in 2009.1 These growing areasof targeted attacks on sensitive information exploit websites by alteringback-end code to manipulate data entered by users and exploits thetrust relationship between users and the websites they visit.

The increase in attacks is due in part to the sheer number of web appli-cations being developed—a number that is skyrocketing. In spite oftheir potential, the interactive nature of these new, collaborative tech-niques for sharing information makes them highly susceptible and vul-nerable to attacks. To help protect your business—and reputation—youneed to find ways to enhance your company’s security solutions.

With web application protection built into the core IBM intrusion prevention engine, IBM offers the same security as a web applicationfirewall to address web-related vulnerabilities and strengthen yoursecurity posture. Integrated into the latest models of the IBM Securityfamily of network and server security products, this feature can helpyou control attacks at the network, gateway and server levels.

IBM SoftwareIBM Security Solutions

Solution Brief

2

IBM Protocol Analysis Modular Technology

Client-sideApplication Protection

Virtual Patch Web ApplicationProtection

ApplicationControl

Threat Detectionand Prevention

Data Security

VIRUS

FEATURING

T E C H N O L O G Y

VIRTUALPATCH

APPLICATION CONTROL

®

DNS POISONING

The IBM protocol analysis module (PAM) drives security convergence todeliver network and server protection that goes beyond traditional IPS.With its modular architecture that allows for extensible protection, PAMnow includes web protection technologies.

Backed by the security expertise of the IBM X-Force®research and development team, we employ a unique proto-col analysis module (PAM) as the core technology of solu-tions to help provide deep-packet inspection. Coupled withthe sophisticated security capabilities of IBM WebSphere®DataPower® appliances, including policy enforcement, fine-grained authentication and authorization, advancedXML threat protection and accelerated Secure Sockets Layer(SSL) processing, this solution helps identify intrusions andassists in blocking malicious packets sent to web applicationsand back-end databases.

Rather than purchasing a stand-alone web application fire-wall, you can take advantage of web protection that is alreadyenabled in trusted IBM Security Solutions, such as:

● IBM Security Network Intrusion Prevention System2,which helps enable preemptive protection against a widevariety of Internet threats

● IBM Security Server Protection products, which help keepdata and applications reliable, available and confidential byproviding automated, near real-time intrusion protectionand detection by analyzing events, host logs and inboundand outbound network activity on critical enterprise servers

● IBM Security Virtual Server Protection, which limits accessto critical data, tracks user access, reports on the virtualinfrastructure and provides defense-in-depth, dynamic secu-rity with VM rootkit detection and virtual infrastructureauditing and monitors traffic with VMsafe integration.

In addition to enhancing web application protection, thePAM engine that fuels the IBM Security network and serverprotection product lines also provides a unique combinationof proactive security methods, including:

● IBM Virtual Patch® technology—Shielding vulnerabilitiesfrom exploitation, independent of a software patch.

● Client side application protection—Protects end usersagainst attacks targeting applications used everyday such asMicrosoft® Office files, Adobe® PDF files Multimedia filesand web browsers.

● Advanced network protection—Advanced intrusion prevention including DNS protection.

● Data security—Monitoring and identification of unencrypted personally identifiable information (PII) andother confidential data.

● Web application security—Protection for web apps, Web 2.0 and databases (same protection as web applicationfirewall).

● Application control—Reclaim bandwidth and block Skype,peer-to-peer networks and tunneling.

IBM SoftwareIBM Security Solutions

Solution Brief

3

Eliminating the need to purchase and manage a separate web securitypoint productBy embedding enhanced security capabilities into the coreengine of the latest models of our intrusion prevention prod-ucts, IBM can help you avoid the added cost and complexityof maintaining stand-alone web application firewalls. Each ofour solutions runs a unique injection logic engine (ILE) togive your network, server and web applications a proactivelevel of protection—a significant advantage over typical secu-rity solutions. If you’re already using the latest network andserver intrusion prevention solutions from IBM, the capabil-ity to provide robust protection specifically for your webapplications is already there. So there’s no need to make anadditional technology investment, and you can manage theentire solution from a single IBM Proventia® ManagementSiteProtector system or through IBM Managed SecurityServices.

Providing a proactive approach to web protectionUsing the ILE as leverage, IBM Security intrusion preventionsolutions with the full security of a web application firewallhelps block attacks on your web applications. The ILE helpspreempt injection attacks by calling out unique patterns notusually seen in valid web requests. By totaling and scoringspecific keywords and symbols, the ILE can detect and subse-quently block SQL injection attacks. Instead of reacting tosecurity breaches after they’re discovered, the ILE takes anattack stance toward injections. Through its comprehensivelist of SQL syntactic cues, the ILE helps protect your system by:

● Evaluating and scoring parameter values● Blocking requests that exceed the scoring threshold● Flagging particular keyword combinations to identify what

type of SQL injection is occurring

This proactive approach to web application security is atypical of many web protection solutions, which merelyaudit attacks and react to them.

IBM Web application firewall capabilities inside our intrusionpreventions solutions help address the primary sources ofattack for:

● Web applications—helps block shell command injections,server-side include (SSI) injections, cross-site scripting(XSS) and directory traversal

● Databases—helps block SQL, Lightweight DirectoryAccess Protocol (LDAP) and XML Path Language (XPath)injections

● Web 2.0—helps block Java™ Script Object Notation(JSON) hijacking, potential cross-site request forgery(CSRF) attacks and advanced cross-site scripting techniques

Delivering holistic web app security byintegrating pro-active protection withvulnerability managementIBM delivers a holistic approach to web application securityby integrating threat mitigation solutions from network IPSand server protection with vulnerability management fromIBM Rational AppScan via a common management platformin IBM Security SiteProtector System. In addition to servingas a command and control console for network and serverprotection, SiteProtector integrates with AppScan to reporton web application vulnerabilities, manage resolution of thosevulnerabilities and provide automated policy recommenda-tions to help block attacks against those specific vulnerabili-ties identified by AppScan.

Easing compliance efforts while helpingto protect your data—and your reputationIBM Web application firewall capabilities help you more eas-ily manage compliance requirements and industry regulations,such as those required by the Payment Card Industry (PCI)Data Security Standard (DSS) 6.6. This standard includesrequirements for security management, policies, procedures,network architecture, software design and other critical pro-tective measures essential to maintaining a security-rich envi-ronment for your customers’ payment card transactions. At

Please Recycle

the same time you gain greater protection for your data, youare also safeguarding your reputation. IBM makes it easier tomanage compliance with PCI DSS 6.6 by including the same full security of a web application firewall in our broadportfolio of IPS solutions.

Why IBM?IBM Web application security is designed to provide a cost-effective solution to help fortify your web applications againstsecurity exposures. This solution leverages our own X-Forceteam of security experts, who evaluate vulnerabilities andsecurity issues, develop assessments and countermeasure tech-nology for IBM Security products and educate the publicabout emerging Internet threats.

When exposures can compromise your data, jeopardize yourreputation or even shut down your business, IBM Web application security can help provide you with coverage thatdoes not require an additional purchase or installation of astand-alone web application firewall. And you can also lever-age the skills and experience of IBM Professional SecurityServices to help you assess your security capabilities, thenplan for, design and deploy an optimal solution for your ITand business needs.

We also offer managed protection services to monitor andmanage your environment to help take this burden off ofyour staff. In addition, IBM Rational AppScan products andservices can perform a security risk analysis of your webapplications. The IBM portfolio of products and serviceshelps you focus on new business initiatives with less worryover where your vulnerabilities lie and how to protect them.

For more informationTo learn more about IBM Web application security, pleasevisit: ibm.com/security

© Copyright IBM Corporation 2010

IBM CorporationSoftware GroupRoute 100Somers, NY 10589 U.S.A.

Produced in the United States of AmericaJuly 2010All Rights Reserved

IBM, the IBM logo, ibm.com and Rational are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both. If these and other IBM trademarked terms are marked on their first occurrence in thisinformation with a trademark symbol (® or ™), these symbols indicateU.S. registered or common law trademarks owned by IBM at the timethis information was published. Such trademarks may also be registeredor common law trademarks in other countries. A current list of IBM trademarks is available on the web at “Copyright and trademarkinformation” at ibm.com/legal/copytrade.shtml

Adobe is a registered trademark of Adobe Systems Incorporated in theUnited States, and/or other countries.

Java is a trademark of Sun Microsystems, Inc. in the United States, othercountries, or both.

Microsoft is a trademark of Microsoft Corporation in the United States,other countries, or both.

Other product, company or service names may be trademarks or servicemarks of others.

References in this publication to IBM products or services do not imply that IBM intends to make them available in all countries in whichIBM operates.

Product data has been reviewed for accuracy as of the date of initialpublication. Product data is subject to change without notice. Anystatements regarding IBM’s future direction and intent are subject tochange or withdrawal without notice, and represent goals and objectives only.

The customer is responsible for ensuring compliance with legalrequirements. It is the customer’s sole responsibility to obtain advice ofcompetent legal counsel as to the identification and interpretation of anyrelevant laws and regulatory requirements that may affect the customer’sbusiness and any actions the reader may have to take to comply with suchlaws. IBM does not provide legal advice or represent or warrant that itsservices or products will ensure that the customer is in compliance withany law or regulation.

1 2009 IBM X-Force Trend & Risk Report.

2 IBM web application security is embedded into the MX and GX modelsof the network IPS product lines.

SES03002-USEN-01