I'm running 2 web servers on 2 different physical hosts at home. They handle both HTTP and HTTPS traffic. I want to protect against web application attacks, but don't want to spend money for additional hardware.

A network IDS is not a possibility because additional hardware is needed. Furthermore, network IDS are having problems with encrypted traffic (HTTPS). In this case, I propose to install and configure 2 host-based IDS on both web servers. Another possibility would be 2 Web Application Firewalls embedded on both web servers. They are easy to add (no changes to network configuration needed) and no additional hardware is required. IDS are clearly monitoring/blocking systems that recognize some web based attacks, but are not specialized at web traffic. My final recommendation is to use embedded WAFs.

Is an embedded WAF the right choice for this scenario?

  • Out of that entire block of writing, I only see one question mark in the middle. It seems to be a giant statement, rather than a question. Please edit to make what you're asking clearer. – Polynomial Aug 24 '12 at 15:46

Yes, if your threat model says that you should be worried about only web application attacks, putting WAF (modsecurity etc) is ideal when no network config changes are desired.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.