I'm running 2 web servers on 2 different physical hosts at home. They handle both HTTP and HTTPS traffic. I want to protect against web application attacks, but don't want to spend money for additional hardware.

A network IDS is not a possibility because additional hardware is needed. Furthermore, network IDS are having problems with encrypted traffic (HTTPS). In this case, I propose to install and configure 2 host-based IDS on both web servers. Another possibility would be 2 Web Application Firewalls embedded on both web servers. They are easy to add (no changes to network configuration needed) and no additional hardware is required. IDS are clearly monitoring/blocking systems that recognize some web based attacks, but are not specialized at web traffic. My final recommendation is to use embedded WAFs.

Is an embedded WAF the right choice for this scenario?

  • Out of that entire block of writing, I only see one question mark in the middle. It seems to be a giant statement, rather than a question. Please edit to make what you're asking clearer.
    – Polynomial
    Commented Aug 24, 2012 at 15:46

1 Answer 1


Yes, if your threat model says that you should be worried about only web application attacks, putting WAF (modsecurity etc) is ideal when no network config changes are desired.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .