I'm running 2 web servers on 2 different physical hosts at home. They handle both HTTP and HTTPS traffic. I want to protect against web application attacks, but don't want to spend money for additional hardware.
A network IDS is not a possibility because additional hardware is needed. Furthermore, network IDS are having problems with encrypted traffic (HTTPS). In this case, I propose to install and configure 2 host-based IDS on both web servers. Another possibility would be 2 Web Application Firewalls embedded on both web servers. They are easy to add (no changes to network configuration needed) and no additional hardware is required. IDS are clearly monitoring/blocking systems that recognize some web based attacks, but are not specialized at web traffic. My final recommendation is to use embedded WAFs.
Is an embedded WAF the right choice for this scenario?