Re: Web application security

["Milan Zdimal" <milanz@xxxxxxxxx>]

Hi Shalom,
Your question isn't very specific. My answer is no. =). But I assume you are
looking for some more information. Here's a good link on how web application
firewalls work:
http://www.networkworld.com/news/tech/2002/0603tech.html

My experience with web application firewalls is that they are generally slow
and cause a head ache in terms of debugging resulting from caching and an
extra layer of obscurity and of course they simply don't protect you from
fundamentally flawed logic that may be in itself be insecure. I believe in
prevention and countermeasures rather then relying on a third party layer
-- Understand the vulnerabilities that affect your specific application.
Check this out: http://www.owasp.org/index.php/Category:Countermeasure

I hope this helps.

Milan Zdimal

On 12/19/06, Shalom Carmel <shalom@xxxxxxxxxx> wrote:
> Hello all,
> Is anyone using "web application firewalls" to protect web applications
> running on as400/iseries?
> These web application firewalls can stop http protocol attacks, cross site
> scripting, sql injection, parameter tampering, cookie poisoning etc
>
> I am talking about web applications or web services for the internet,
> intranet and extranet.
>
>
>
> Regards,
> Shalom Carmel
> -----------------------
> www.venera.com
> --
> This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
> To post a message email: WEB400@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/web400
> or email: WEB400-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/web400.