Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I'm running 2 web servers on 2 different physical hosts at home. They handle both HTTP and HTTPS traffic. I want to protect against web application attacks, but don't want to spend money for additional hardware.

A network IDS is not a possibility because additional hardware is needed. Furthermore, network IDS are having problems with encrypted traffic (HTTPS). In this case, I propose to install and configure 2 host-based IDS on both web servers. Another possibility would be 2 Web Application Firewalls embedded on both web servers. They are easy to add (no changes to network configuration needed) and no additional hardware is required. IDS are clearly monitoring/blocking systems that recognize some web based attacks, but are not specialized at web traffic. My final recommendation is to use embedded WAFs.

Is an embedded WAF the right choice for this scenario?

share|improve this question
Out of that entire block of writing, I only see one question mark in the middle. It seems to be a giant statement, rather than a question. Please edit to make what you're asking clearer. – Polynomial Aug 24 '12 at 15:46
Now it should be clearer, thanks for your input. – Moo Aug 24 '12 at 15:58

1 Answer

up vote 1 down vote

Yes, if your threat model says that you should be worried about only web application attacks, putting WAF (modsecurity etc) is ideal when no network config changes are desired.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.