securing web applications with fortiweb and fortisandbox...devices shipped 30%+ growth employees...
Post on 28-Sep-2020
3 Views
Preview:
TRANSCRIPT
© Copyright Fortinet Inc. All rights reserved.
Securing Web Applications with FortiWeb and FortiSandbox
Shaun Carriveau Channel Systems Engineer
4/19/2017
4
Fortinet
» Who we are and what we do
FortiGuard Labs
» The “Secret Sauce”
Threat Landscape
» Understanding Security Challenges
FortiSandbox
» Identifying the unknown
FortiWeb
» Protecting the web based applications
Agenda
Fortinet
Company Overview
6
Fortinet Facts
#1 UNIT SHARE WORLDWIDE
In Network Security (IDC)
$ 1.3B REVENUE
FOUNDED
2000 OVER
3 MILLION DEVICES SHIPPED
30%+ GROWTH
EMPLOYEES
4,650+
300,000+ CUSTOMERS
MARKET LEADING
TECHNOLOGY
358+ PATENTS
292+ PENDING
100+ OFFICES WORLDWIDE
SUNNYVALE, CA
HQ
IPO
2009
7
Fortinet: Global Network Security Leader
Fortune Companies
in America
of the
TOP 7 10
Fortune Companies
in EMEA
of the
TOP 8 10
Fortune Companies
in APAC
of the
TOP 9 10
Fortune
Telecommunications
Companies
10 of the
TOP 10
Fortune Retail and Commercial
Banks
9 of the
TOP 10
Aerospace and
Defense
7 of the
TOP 10
FortiGuard Labs
The “Secret Sauce”
9
FortiGuard Threat Map
10
The FortiGuard Minute
Per Minute
21,000 Spam emails intercepted
470,000 Network Intrusion Attempts resisted
95,000 Malware programs neutralized
160,000 Malicious Website accesses blocked
32,000 Botnet C&C attempts thwarted
43 million Website categorization requests
Per Week
46 million New & updated spam rules
1,000 Intrusion prevention rules
108 million New & updated AV definitions
1.4 million New URL ratings
8,000 Hours of threat research globally
Total Database
326 Terabytes of threat samples
19,000 Intrusion Prevention rules
5,800 Application Control rules
250 million Rated websites in 78 categories
375 Zero-day threats discovered
Based on Q2 2016 data
Image: threatmap.FortiGuard.com
11
FortiGuard by the numbers
Threat Landscape
Understanding Security Challenges
13
Infrastructure. Constant Change.
Green Google’s 13 data
centers use 0.01%
of global power
SDN/NFV Software-defined
everything. SD WAN
SaaS On average, companies
have 10+ applications
running via the Cloud
IaaS Security still the
No.1 inhibitor
IoT 35B devices, mostly
headless attaching
to the network
Virtualization 80% of data center
apps are virtualized
Mobile No control of
endpoints (BYOD)
Social Bandwidth ever
increasing
Bandwidth Wi-Fi speeds rival LANs.
100G networks here
Analytics Big Data
Internet 2 100 Gbps and
UHDTV
5G Wireless
FUTURE
100G
TODAY
14
Security is borderless.
Branch Office Campus
Data Center
Remote Office
Mobile
IoT
PoS EndPoint
Mobile
1. The attack surface has
increased
2. Strategy changes bring
new security challenges
3. There are security holes
in existing infrastructure
(ATP, unsecured
wireless, no dedicated
security...)
=> Security is Borderless
0-Day
FortiSandbox
Identifying the Unknown
16
Advanced Threat Protection • Multi-layered filtering with Code Emulator, AV engine, Cloud
query and Virtual OS sandbox
• Handles multiple file types, includes files that are encrypted or
obfuscated
• Examine files from various protocols, included those that uses
SSL encryption
Flexible Operation Modes • Receives file sample using integration with FortiGate/FortiMail,
sniffer mode and manual file uploads
• Capture files from remote locations using deployed FortiGates
Monitoring and Reporting • Detailed analysis reports and real-time monitoring and alerting
Introducing FortiSandbox
File Submission
Malicious
Analysis
output
Latest AV Signature Update
2
3
4
Centralized File Analysis 1
?
Advanced Threat Protection solution designed to identify and
thwart the highly targeted and tailored attacks
17
KEY SANDBOX COMPONENTS
Call Back Detection
Full Virtual Sandbox
Code Emulation
Cloud File Query
AV Prefilter
• Quickly simulate intended activity
• OS independent and immune to evasion/obfuscation
• Apply top-rated anti-malware engine
• Examine real-time, full lifecycle activity to get the
threat to expose itself
• Check FortiSandbox community intelligence & file reputation
• Identify the ultimate aim, call back & exfiltration
• Mitigate w/FortiGuard updates
Intelligence Sharing • Distribute real-time updates
• Feed global systems
18
CPRLSIG
TYPE(pe)
H(IS_NOTDLL)
SZ(GT,8000)
setIP(PE_HEADER)
W(0x5c) chk(word & 2, 2) //check subsystem version
getSecNum()
setIP(SECTION_HEADER)
W(8) getD($m1) // last section VS
W(4) getD($m2) // last section RS
cmp($m2 >= 0x2300) cmp($m1 >= 0x2300) // min
W(0x10) chk(dword & 0xE0000060, 0xE0000060) // last
section char
S(1,END) op($m1 = $IP) op($m1 -= 0x2000)
S(0x2a00,END)
CheckEncVirut:
I(L(0x100,81 e3 00 f0 ff ff),CHECK_NOTENCRYPTED_VIRUT)
// Implement X-ray detection
I(getKey(XOR_B, E8 00 00 00 00), POS_XOR)
TRY_SUB: I(getKey(SUB_B, E8 00 00 00 00), POS_SUB)
TRY_SUBADD: I(getKey(SUB_B, ADD_B, E8 00 00 00 00),
POS_SUB_ADD)
TRY_XORADD: I(getKey(XOR_B, ADD_B, E8 00 00 00 00),
POS_XOR_ADD)
TRY_NEXT_EP:
// brute force?.... hehehehe
I(cmp($m6 == 1),SrchAgn1)
op($m6 = 1) // set flag
R(-1) G(CheckEncVirut)
SrchAgn1:
TRY_SUB: I(getKey(SUB_B, E8 00 00 00 00), POS_SUB)
TRY_SUBADD: I(getKey(SUB_B, ADD_B, E8 00 00 00 00),
POS_SUB_ADD)
TRY_XORADD: I(getKey(XOR_B, ADD_B, E8 00 00 00 00),
POS_XOR_ADD)
TRY_NEXT_EP:
// brute force?.... hehehehe
I(cmp($m6 == 1),SrchAgn1)
op($m6 = 1) // set flag
R(-1) G(CheckEncVirut)
SrchAgn1:
I(L(0x1000,00 00 00 00),Cont1)
I(L(0x1000,00 00 00 00),Cont1)
I(cmp($m5 == 3),ExitSig)
I(cmp($m5 == 1),Vir10)
I(cmp($m5 == 2),Vir11)
cmp($m5 == 0)
getSecNum()
setIP(SECTION_HEADER)
W(8) getD($m1) // last section VS
W(4) getD($
S(0x2c00, END)
Life of a Sample
?
1 Advanced Malware Threat Protection
1. Code Emulation engine is
focusing on encrypted and/or
packed malware. No code evasion
possible as this code is not run.
2. Realtime AV Engine decrypts,
decodes then tracks behaviors of
polymorphic code.
3. CPRL (patented) is used to detect
suspicious code and behavior of a
virus and all variants.
19
#
Life of a Sample
FortiGuard Services
1. Fortiguard Cloud File Query #1 : a hash of the file is sent to
Fortiguard Service and checked against our intelligence
database.
It is the last chance to detect a malware before the
sandbox analysis (step 3).
2. Fortiguard URL Rating: during sandbox analysis, all
connections attempts to any web URL are checked against
Fortiguard Webfiltering database.
3. Fortiguard IP Rating: during sandbox analysis, it detects
connection attempts to C2 servers.
4. Fortiguard Cloud File Query #2: all files generated during
the sandbox analysis are sent to the intelligence databse.
5. Fortiguard File Submission: If sandbox analysis verdict is
suspicious, entire file is submitted to Threat Intelligence
Sharing with the FortiGuard Community.
?
fortiguard
2
20
Life of a Sample
Sandbox Analysis
?
Alert VIRUS
3
21
Life of a Sample
Sandbox Analysis
1. Execution of the file in an emulated environment. All
major windows & android releases supported.
2. Anti Evasion techniques
3. Analysis performed by a sophisticated tracer engine.
4. Complete Reporting: Network activity is captured, all
processes are detailed and listed, all changes are
tracked, logs and original files are available for
download.
Windows XP Windows 7
Windows 8 Windows 10
3
22
Life of a Sample
Rating Engine
1. Clean / Unknown: not detected as suspicious / malicious or the
file could not be processed. It might be re-processed later.
2. Suspicious: Low means the sample is a riskware, medium
represents downloaders or adwares or greywares, high risk is
usually an infector, a dropper or a hijacker…
3. Malicious: the sample is a virus detected by the extended AV
techniques and engines.
Static Analysis
Fortiguard Intelligence
4
23
FortiSandbox Series
FortiSandbox FSA-1000D FSA-3000D FSA-3000E FSA-3500D FSA-VM
VM Sandboxing
(Files/Hour) 160 560 1,120
720* (Upgradable** to
1,200) (160 per node) Hardware Dependent
AV Scanning
(Files/Hour) 6,000 15,000 15,000
30,000* (Upgradable**
to 48,000) (6,000 per
node)
Hardware Dependent
Number of VMs
(WinXP, 32-bit) 8 28 8 + 48 optional
36* (Upgradable** to
60) (8 per node) Total: 2 to 54
Interfaces 6x GE RJ45 ports, 2x
GE SFP slots
4x GE RJ45 ports, 2x
GE SFP, 2x 10GE
SFP+ slots
4x GE RJ45 ports, 2x
10GE SFP+ slots
20x GE RJ45 ports,
10x 10 GE SFP+ slots
(4x GE RJ45 ports, 2x
10 GE SFP+ slots per
node)
Hardware Dependent
FSA-3500D: comes with default 5 nodes, up to 8 maximum
* Based on the assumption that 1 blade will be used as master in HA-cluster mode.
** By adding 3 more SAM-3500D nodes to the same chassis..
24
FortiSandbox Series
FSA-1000D FSA-3000D FSA-VM FSA-CLOUD
VM Sandboxing
(Files/Hour) 160 560 Hardware Dependent Unrestricted
AV Scanning
(Files/Hour) 6,000 15,000 Hardware Dependent Unrestricted
Number of VMs 8 28 4 to 54 Not applicable
Interfaces 6x GE RJ45 ports, 2x GE SFP
slots
4x GE RJ45 ports, 2x GE
SFP, 2x 10GE SFP+ slots Hardware Dependent Not applicable
Scan Engines Similar scan engines across all platforms (release dates may vary)
Input methods FortiGate, FortiMail Integration, Sniffer mode, manual on-demand file upload, submission API,
network file share inspection
FortiGate, FortiWeb, FortiMail
Integration
Status & Analysis
Visibility
Full (rating, source, destination, MD5/SHA, observed behaviors, full logs, pcap, etc) on-box,
statistics overview on FGT only
FortiGate, FortiWeb, FortiMail.
Detailed reports on FG only.
Info submission to
FortiGuard Labs
None or all information related to analysis of “low/medium/high risk” objects, based on customer
configuration All info if rated with risk levels
File Quarantine On-box file quarantine for network file share scanning. FortiMail submits and queues mails for
suspicious content NIL
Protection Manual policy configuration, FortiGuard AV signature update, requires FortiGuard premium service
for SLA
Source Quarantine on FGT
(*V5.2.3+)
*roadmap, may subject to changes
25
FortiGate, FortiMail, FortiWeb, FortiClient » Block as many threats as possible
» Submit at risk objects for additional analysis
» Mitigate previously unknown threats
Sandbox for Payload Analysis » Accept at risk objects for additional analysis
» Execute objects to assess and rate risk
» Provide intelligence and generate updates for
prevention products
Identify more, previously unknown, threats
Minimize the cost of comprehensive coverage
Speed and simplify response
ADVANCED THREAT PROTECTION IN ACTION
Network
FortiGate, FortiMail, FortiWeb
FortiSandbox
Callback
Detection
Cloud
File Query
AV
Prefilter
Code
Emulation Full
Sandbox
FortiClient
FortiWeb
Protecting Web Based Applications
27
Web Application Security Trends
Web application vulnerabilities
are a top source of breaches
IPS alone can not protect
against zero-day threats
PCI compliance needed to
accept/process credit cards
Non-compliance needs growing
Strong awareness and top 5
investment priority with CIOs
11.6% of web sites use HTTP/2
Notes/Sources:
1. Verizon 2016 Data Breach Report.
2. Gartner Magic Quadrant for Web Application Firewalls 2016.
3. IDC Research WAF market size and growth estimates for 2016 to 2020; includes hardware and
hosted WAF services.
$1.5B+
Market size with a CAGR
of 6% expected through
20203
100%↑
Published Critical
Vulnerabilities exploited in
1 year1
40% of data breaches caused
by application
vulnerabilities1
80% of enterprises to have
Web Application Firewalls
by 20182
28
Acunetix Web Application Vulnerability Report 2016
Annual report by
Acunetix
Based on random
sample of 5,700 of
their customers
Web application
vulnerabilities
increasing YoY 2015-
2016
55% susceptible to
high priority
vulnerabilities
Full report at
acunetix.com
SOURCE: Acunetix Web Application Vulnerability Report
2016, published on August 30, 2016.
29
Scope/Definition of WAFs
Protects web-based applications from code-
based attacks
» SQL Injection or other injection types
» Cross Site Scripting and Request Forgery
» Layer 7 DoS/DDoS attacks
» Cookie poisoning
Protects against application vulnerabilities in
custom code and commercial platforms
Understands/learns “normal” behaviors and
stops anomalies
» URL parameters, HTTP methods, session IDs,
cookies, etc.
Dynamic and adaptive to adjust
to new threats
Can’t a Firewall or IPS do this?
Firewalls look for network-based attacks
IPS Signatures detect only known
problems
» High rate of false positives
» No protection of SSL traffic
» No application or user awareness
FortiWeb WAF
Web Application
Servers
SQL Injection, XSS…
INTERNET
30
WAF Drivers/Challenges
Protect current and existing applications from
code-based vulnerabilities
Meet PCI 6.6 Compliance for credit card and
healthcare data
Address OWASP Top 10 Application
Vulnerabilities
Identify and address web application
vulnerabilities
Website publishing for Microsoft and other
applications
Protect against website defacement
Who Needs it?
Any organization that processes credit cards
and/or has PCI requirements
Large internal or external applications
Sensitive/proprietary information
Mission-critical business applications
Who Needs it Most?
MSPs/Hosting Companies
E-commerce/online services
Retail, Food Service, Hospitality
Financial services
Healthcare
31
FortiWeb – Web Application Firewalls
7 models from 25 Mbps to 20 Gbps throughput
Up to 8x GE and models with 4x 10GE SFP+ ports
Native HTTP/2 WAF protection
Hardware and VM options
FortiGate, FortiSandbox, and FortiAnalyzer Integration
Automatic behavior-based scanning
Auto setup/learning mode
Layer 7 DDoS protection
FortiGuard antivirus, IP reputation, FortiSandbox
Cloud, and WAF signatures
Transparent, reverse and non-inline deployment
Central Management/ADOMs
REST API
Included vulnerability scanner
Virtual Patching/3rd Party support
Advanced False Positive Mitigation
Advanced real-time reporting
SSL offloading/compression
SSO/Authentication
Layer 7 load balancing
Fastest Web Application Firewall in the Industry
32
• VM01
• VM02
• VM04
• VM08
• 1 to 8 CPUs supported
• Unlimited memory
support
• Up to 10 Network
Interfaces
• 40 GB to 1 TB storage
supported
• VMware, Hyper-V, Citrix
XenServer, Open Source
Xen, KVM, Amazon Web
Services (AWS), Azure
FortiWeb VMs
FortiWeb Product Line P
erf
orm
an
ce
& S
ca
lab
ilit
y
WAF < 1 Gbps 1 – 10 Gbps 10+ Gbps
SSL Software SPU/ASIC SPU/ASIC
Ports GE GE/10GE GE/10GE
25 Mbps
100 Mbps
250 Mbps
FWB-400D
FWB-100D
FWB-600D
1.0
2.5
5.0
FWB-1000E
FWB-3000E
FWB-2000E
20.0 FWB-4000E
33
FortiWeb Benefits
Protect applications with automatic usage profiling and anomaly scanning
Meet PCI 6.6 Compliance with behavior-based attack detection and mitigation
Full protection against OWASP Top 10 Application Vulnerabilities
ATP Integration with FortiSandbox and FortiGate Quarantined IP Polling
Identify weaknesses with built-in vulnerability scanning
Protect enterprise applications with 3rd party scanner Virtual Patching
Advanced False Positive Mitigation with Syntax-based Detection, User Scoring and Session
Tracking
Simplified deployment with FortiGate using WCCP Integration
34
FortiWeb Multi-layer WAF Protection
ATTACKS/THREATS
APPLICATION
CO
RR
EL
AT
ION
IP REPUTATION BOTNETS, MALICIOUS HOSTS,
ANONYMOUS PROXIES, DDOS SOURCES
DDOS PROTECTION APPLICATION LEVEL
DDOS ATTACKS
PROTOCOL VALIDATION IMPROPER
HTTP RFC
ATTACK SIGNATURES KNOWN APPLICATION
ATTACK TYPES
ANTIVIRUS/DLP VIRUSES, MALWARE,
LOSS OF DATA
BEHAVIORAL VALIDATION UNKNOWN APPLICATION
ATTACKS
ADVANCED PROTECTION SCANNERS, CRAWLERS,
SCRAPERS
INTEGRATION FORTIGATE AND FORTISANDBOX
APT DETECTION
35
Auto Setup and Protection
Key Features » Auto learn
» Completely transparent
» Traffic pattern monitoring
» Models application based on usage patterns
» Understands real behavior
Benefits » No application changes
» Traffic anomalies trigger actions
» Protects against unknown vulnerabilities and zero-day attacks
36
Key Features
» Scans all application elements
» Granular crawling capabilities
» Scheduled or on demand
» Recommendation reporting
» FortiGuard updates
Benefits
» Automated vulnerability reporting
» Complements WAF for PCI
DSS compliance
Vulnerability Scanning
37
Integration
WCCP
External
WAF
ON
FortiGate
FortiWeb
HTTP Traffic
Quarantined IPs
Web
Server
FortiSandbox
Files for
Inspection
Third Party
Scanners
FortiGate
» IP Polling
» WCCP Protocol
FortiSandbox
» File scanning
» APT protection
» Cloud integration Aug 2016
Third-party Scanners
» IBM AppScan and QRadar
» HP WebInspect
» WhiteHat
» Qualys
» Acunetix
38
First ever user scoring system on a WAF
Trigger events can be set to thresholds
If thresholds are met, then attacker is blocked
Can use multiple combinations of triggers and attack types
Minimizes false positive detections
Track users throughout session lifetime
FortiWeb Threat Scoring
FortiWeb
TH
RE
AT
SC
OR
ING
RULE 1
RULE 2
RULE 5…
RULE 4
RULE 3
User 1
Threat Score
18
User 2
Threat Score
22
User 3
Threat Score
78 BLOCKED
39
FortiWeb User Tracking
Automatic recognition of user logins
Users tracked throughout entire
session by binding user name to
session ID
Suspicious activity can be traced back
to user account
All activity tracked, ‘good’ and ‘bad’
Login pages set up by Admin
Aids in attack forensics and identifying
malicious/compromised users
Joe – Active
Session ID: 3450001AB
Login Page
Account Page
Admin Page
Mark – Active
Session ID: 5499459DE
Login Page
Product Pages
Shopping Cart
John – Logged Out
Session ID: 9984578C2
Login Page
Product Pages
Shopping Cart
Activity stored in logs
Jessica – Not Active
Session ID: N/a
Will be tracked once
logged into application
40
Alert Tuning
Granular
exception/whitelist
creation
Automatic Auto Learn
exceptions
Correlation
Threat Scoring
Additional filtering
layers
Code-based Syntax
Analysis and SQL
Injection Validation
False Positive/Negative Mitigation
41
SQL Injection Validation
SQL injection protection accuracy is difficult,
causes many false positives
SQL commands use common English words
Signatures limited to pattern matching of
SQL commands
Will falsely trigger blocking in many cases -
too many SQL words are used, special
characters used (‘,--,”), etc.
Validation reviews suspected events for
proper SQL usage to determine if an attack
is real
Dramatically reduces false positives
I need to SELECT a party location for my GROUP at
work WHERE it’s close to the station for those that are
coming BY train FROM the city.
SELECT *
FROM customer_records
WHERE credit_card IS NOT NULL
GROUP BY state
Form field that could trigger SQL Injection Attack
Form field that is validated as an attack by FortiWeb
ALLOWED
BLOCKED
42
Syntax-based SQL Injection Detection
New sophisticated method to prevent
SQL Injection attacks
Engine uses true SQL context; no
signatures required
SQL statements are inspected at “key
points” of injection as identified by top
security researchers
If an attempt is made to attack through
a SQL statement key point, the attack
is blocked
Virtually eliminates all false positive
and negative detections
www.example.com/test.asp?id=7
Valid SQL Usage (Key Point is normal)
Attempt made to manipulate a Key Point
ALLOWED
www.example.com/test.asp?id=1’ OR 1=1
BLOCKED
43
FortiGuard Labs
» Award-winning threat
research services
» Dynamic/automated
updates for FortiWeb
» Automatic downloads
» Always up-to-date
Subscription Based
» Available per device
» Select services that are needed
» Annual renewals
» Bundle options available
FortiGuard Services
Security Service
• Application layer
signatures
• Malicious bots
• Suspicious URL
pattern
• Web vulnerability
scanner updates
IP Reputation
• Protection for
automated attacks
and malicious
sources
• DDoS, Phishing,
Botnet, Spam,
Anonymous proxies
and infected sources
Antivirus
• Scan file uploads
• Regular and
extended AV
databases
FSX Cloud
• FortiSandbox hosted
by Fortinet
• Subscription-based
• No separate
sandbox required
44
Fortinet Recognized by Gartner for Enterprise WAF
FortiWeb positioned as “Challenger” in 2016 Magic Quadrant for Web Application Firewalls
FortiWeb moves from “Niche Player” to “Challenger” in Gartner’s
assessment of the WAF marketplace in 2016. Feature enhancements,
high-performance models, and Fortinet Fabric integration were seen
as key contributing factors.
Strengths:
• Brand reputation, competitive prices, and integration
• Solid hardware product line with accelerated SSL decryption
• FortiSandbox integration for enhanced AV and malware protection
• Enterprise-focused enhancements (20 Gbps appliance, HSM and
third-party AST support)
• Broad feature set, includes IP reputation (FortiGuard), cookie
signing, SSL acceleration, and web application caching
This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire
document. The Gartner document is available upon request from Fortinet. Gartner does not endorse any vendor, product or service depicted in
its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation.
Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact.
Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a
particular purpose
Gartner, Magic Quadrant for Web Application Firewalls, July, 2016
45
NSS Labs Web Application Firewall (WAF) Comparative Report — SVM
Web Application Firewall (WAF) Comparative Report_SVM_041117 2
Overview Empirical data from individual Test Reports and Comparative Reports is used to create NSS Labs’ unique Security
Value Map™ (SVM). The SVM illustrates the relative value of security investment by mapping the Security
Effectiveness and the Total Cost of Ownership (TCO) per Protected Connections per Second (CPS) (or Value) of
tested product configurations. The terms TCO per Protected CPS and Value are used interchangeably throughout
the Comparative Reports.
The SVM provides an aggregated view of the detailed findings from NSS’ group tests. Individual Test Reports are
available for each product tested and can be found at www.nsslabs.com. Comparative Reports provide detailed
comparisons across all tested products in the following areas:
Security
TCO
Performance
Figure 1 – NSS Labs’ 2017 Security Value Map (SVM) for Web Application Firewall (WAF)
FortiWeb Recommended by NSS Labs
WAF Security Value Map Published on April
11, 2017 (current version)
Test Categories
» OWASP Threats; 10 categories (Security
Effectiveness)
» Evasions/Stability/Reliability
» Performance
Fortinet FortiWeb 3000E earned a
Recommended rating
Strong performance with 98% block rate
and 41,120 connections/second
Passed all tests for evasion techniques and
for stability and reliability
46
FortiWeb Competitive Advantages
FortiWeb is the fastest WAF on the market today
Only WAF with FortiGate NGFW and Sandbox integration
Only WAF with vulnerability scanner and antivirus built-in
Industry-first WAF features (Scoring/Tracking, Syntax Analysis)
Low TCO compared to F5 and Imperva
Product Comparisons
FortiWeb Barracuda Imperva F5 Citrix
Throughput (Gbps) 0.025 – 20.0 0.25 – 4.0 0.1 – 10 Not Available 0.5 – 5.0
SSL Offloading Yes Yes Yes Options Options
Security Effectiveness* 99.85% 99.97% 99.82% 99.89% 99.77%
TCO/Protected Mbps* $2.77 $4.88 $15.85 $3.38 $1.93
Vulnerability Scanner Included Separate Separate Separate Separate
Antivirus Included Separate Separate Separate Separate
IP Reputation Yes Yes Yes Yes Yes
L7 Load Balancing Yes Yes Yes Yes Yes
SSL Offloading Yes Yes Yes Yes Yes
* From NSS Labs 2014 Web Application Firewall Security Value Map
47
Purchase price includes:
» Hardware: appliance,
mounting hardware, etc.
» VM: Downloadable software
and license
» 90 days of FortiCare 8x5 support
FortiCare
(1, 2 and 3 year increments):
» 8x5 Enhanced
» 24x7 Comprehensive
FortiGuard
» IP reputation
» FortiWeb Security Service
» Antivirus
» FortiSandbox Cloud
Central Management (separate)
» Up to 10 FortiWeb appliances
» Unlimited option
AWS
» Bring Your Own License (BYOL)
» On-demand licensing through AWS marketplace
Microsoft Azure
» Bring Your Own License (BYOL)
» VM04 and VM08 only
Pricing/Licensing
48
Objection Handling
We regularly review our applications for security flaws, we don’t need a WAF
» A WAF can automatically protect applications without the need to constantly manage existing older applications; frees up resources
Only our developers know the code well enough to address security issues
» Even the best of programmers can’t account for every possible vulnerability, and they can’t predict unknown problems in advance
We’ve never had a data breach and our other security measures are good enough
» Over 96% of all web-based applications have been attacked in 2013. Chances are you have been attacked and may not have
known about it.
Why do a I need a standalone WAF instead of a module on an ADC?
» A dedicated WAF appliance will not decrease performance, plus an appliance like FortiWeb has the processing power to perform
behavior-based detection of application attacks. Most WAF modules on ADCs are very limited.
I’ve never heard of Fortinet for WAF? Why should I look at a FortiWeb?
» FortiWeb has been in the WAF market for over 5 years. We’re a leader according to NSS labs with over 99.85% security
effectiveness against today’s latest web application threats.
49
Qualifying Questions
How do you protect your web-based applications from attacks?
» Look for opportunities to have a WAF automate manual processes like application security patches and code changes on older
applications.
Do you regularly conduct code security reviews and if so, how often?
» If they’re not doing it, they’re most likely at risk. If they are, they are most likely spending a lot of effort to conduct these reviews. A
WAF can automate and protect better.
Do you need to meet PCI DSS compliance standards? What were the results of your last PCI DSS audit?
» If yes, they most likely need a WAF for PCI DSS 6.6. If not, then it’s a harder sell to protect applications, however focus on mission
critical systems, sensitive user and proprietary data protection.
Are you concerned about data breaches of sensitive customer or proprietary information through your
web-based applications?
» The answer should be “yes”. If so, only a WAF can protect against application specific attacks.
50
Additional Resources
White Papers
» Beyond the Firewall
» WAF or NGFW with IPS to Protect Applications
Solution Guides/Briefs
» Fortinet Virtual Appliance Solutions (AWS)
» Protecting Against Layer 7 DoS Attacks with FortiWeb
» OWASP 2013 and FortiWeb
Deployment Guides:
» Replacing Microsoft TMG with FortiWeb for Publishing applications
Positioning Guides/Responses:
» NSS Labs WAF SVM Talking Points
» NSS WAF SVM and Product Analysis Report
top related