There was recently a Twitter by Robert Westervelt about Web Application Firewalls (WAF). Specifically he made the following Tweet, "I learned that firms serious about secure software development aren't deploying Web App Firewalls. Are they for sissies?"

I thought that this was an interesting tweet, and one worth responding to. However, because I work for a data security company which has a WAF offering - Imperva SecureSphere, I realize that anything I say might seem biased. I also know that any written case studies I forward might be construed as having too much vendor polish, since again, I do in fact work for a vendor, and to quote the Hunt for Red October - "When I'm not kissing babies I'm stealing their lollipops." So what to do, what to do.

I figured the best way to respond would be to hear - not read - a few examples of what customers are actually saying about their use of the Imperva SeucreSphere WAF solution. Luckily we just happen to have such material handy from several customers gracious enough to share their stories with the public. While this is a small subset of a 1000+ customer base, I think it will get the general value points across.  For those interested in how organizations that are serious about security leverage Web Application Firewalls, simply give some of these a listen.

• Podcast with Telefonica O2 Germany
• Podcast with Agilent
• Podcast with Vonage
• Webcast with SuccessFactors
• Or check out all the Imperva podcasts on iTunes

But Brian, we need a little more; what are the analysts saying?

Hot off the presses - 08.19.2009 -- Niel MacDonald from Gartner just published the following blog entry titled "Security No-Brainer #9: Application Vulnerability Scanners Should Communicate with Application Firewalls"  This is a great blog entry which brings together a concept that Imperva is a huge proponent of - WAF and VA integration to effectively and efficiently mitigate risks. Bottom line, WAF, SDLC, VA Black & White Box Analysis etc, etc are synergistic solutions - not competitive. If you would like to hear more about WAF+VA, we also have a Podcast on that subject with Jeremiah Grossman - Founder and CTO of Whitehat security, and a Video on YouTube from when Jeremiah and I were talking at RSA 2009 in San Francisco.

Enjoy.