Cloud-native Solution for Web Application Security: FortiWeb Cloud PDF

Cyber ??Risk Managed Services – Sécurité des applications . 4. Une solution de sécurité complète pour les applications. 5. Sécurité des applications - Approche du cycle de vie.

Cloud-native Solution for Web Application Security: FortiWeb Cloud

16 oct. 2019 FortiWeb Cloud WAF-as-a-Service (WaaS) delivers full-featured cost-effective security for web applications with a minimum of configuration ...

Cloud-Native Solution for Web Application Security: FortiWeb-Cloud

24 juin 2019 FortiWeb-Cloud WAF-as-a-Service (WaaS) delivers full-featured cost-effective security for web applications with a minimum of configuration ...

The state of application security in 2021

least one security breach from an application vulnerability it's solutions available

Towards Application Security on Untrusted Operating Systems

retrofitting protection in commodity operating systems. We explore how malicious behavior in each major OS sub- system can undermine application security

Fortinet

23 févr. 2018 The latest generation of enterprise firewalls and intrusion prevention systems (IPS) primarily focus on securing the network and controlling ...

Finding a Better Solution For Web Application Security

25 sept. 2018 to include solutions such as web application firewalls secure application delivery controllers

Micro Focus

Fortify WebInspect is the industry-leading web application security assessment solution designed to thoroughly analyze today's complex.

The Total Economic Impact™ Of Microsoft Cloud App Security

Microsoft provides its Cloud App Security solution (MCAS) which is a solutions that help organizations protect their cloud applications against a.

Application Security Remediation and Risk Mitigation Solutions

63 % des applications d' entreprise développées en interne n'ont jamais été revues du point de vue de la sécurité . Candidature .

Cloud-native Solution for Web Application

Security: FortiWeb Cloud WAF-as-a-Service

Executive Summary

FortiWeb Cloud WAF-as-a-Service (WaaS) delivers full-featured, cost-ef fective security for web applications with a minimum of configuration and management. D elivered through multiple clouds such as Amazon Web Services (AWS) and Microsof t Azure, FortiWeb Cloud WaaS features a high level of scalability as well as on-d emand pricing. While FortiWeb Cloud WaaS can protect applications deployed in the data center or in the cloud, customers who host their applications on AWS can achiev e benefits such as reduced latency, simplified compliance, and lower bandwidth co sts.

Securing Web Applications

Cloud service providers and application owners share the responsibility for securing web applications deployed to the cloud. This arrangement has advantages in t hat providers

typically deploy robust security for the platform itself, removing that burden from the application owner. However, securing the application itself rests squarely with the owner, a

stipulation that cloud providers make clear in their service agreements. Best practices for web application security include the deployment of a web application firewall (WAF) as the cornerstone of a comprehensive security solution. WAFs use a combination of rules, threat intelligence, and heuristic analysis of traffic to ensure that malicious traffic is detected and blocked before reaching web applications. The task of protecting on-premises application software typically falls to a security architect or

FortiWeb Cloud

WaaS Features

Advanced protection against

OWASP Top 10 threats, zero-day

threats, and more Purchasing flexibility - buy directly from multiple cloud marketplaces or through a preferred reseller

Easy deployment with a setup

wizard and predefined policies

Streamlined management with an

intuitive dashboard for end-to-end security visibility and management

Delivered on multiple clouds, which

offers low latency and unmatched elasticity and scalability

SOLUTION BRIEF

other security professional within the CIO or CISO organization. In contrast, the DevOps team often fills this role for cloud-based

applications, consistent with DevOps principles of end-to-end responsibility and cross-functional, autonomous teams. As a result, DevOps

teams need the right tools to embed effective security controls into their process - simply repurposing traditional workflows and processes will not do the job. Also, the additional workload of managing WAFs consumes valuable time on the part of DevOps teams and can

elongate time-to-release cycles and inhibit continuous improvement efforts.

The Expanding Attack Surface

The threat landscape today can be daunting for organizations considering a move to the cloud. More than three-quarters of successful attacks are motivated by financial gain, 2

which can take the form of ransomware, exfiltration of valuable personal information, or compromised intellectual

property. Furthermore, breaches happen fast - 87% take place in just minutes 3 - and most go undiscovered for months or more (Figure 1). 4 Figure 1: Threat statistics from recent published studies. 76%
of breaches are financially removed.87% of compromise take minutes or less. 68%
of threats go undiscovered for a month or more.

SOLUTION BRIEF | Cloud-native Solution for Web Application Security: FortiWeb Cloud WAF-as-a-Service

Internet-facing web applications pose unique security challenges compared to traditional solutions deployed within the organization's

network perimeter. Every time a company deploys a new internet-facing web application, the attack surface grows. As DevOps teams

accelerate the rate of development and new releases, the attack surface evolves more rapidly than ever. This expanded attack surface

challenges traditional approaches to application security.

Enhanced Protection with FortiWeb

To address the diverse needs of organizations for web application security, Fortinet offers the FortiWeb family of solutions. FortiWeb WAF provides

advanced features that defend web applications from known and zero-day threats. Using an advanced multilayered and correlated approach, FortiWeb

delivers complete security for external and internal web-based applications from the OWASP Top 10 and many other threats. At the heart of FortiWeb

are its dual-layer artificial intelligence (AI)-based detection engine s that intelligently detect threats with nearly no false positive detections.

FortiWeb Cloud WaaS

Designed for web applications that demand the highest level of protection, FortiWeb Cloud WaaS provides robust security that is simple

to deploy, easy to manage, and cost effective. With FortiWeb Cloud WaaS, DevOps teams and security architects alike have access to the

same proven detection techniques used in other FortiWeb form factors without the need for costly capital investments. Unlike

solutions that

simply spin up virtual machines for each customer and increase the management workload, FortiWeb Cloud WaaS delivers a true Software-as-a-Service

(SaaS) solution that leverages various public cloud plat to offer highly scalable and low-latency application security.

FortWeb VM

FortiWeb VM is an enterprise-class offering that provides the FortiWeb functionality in a virtual form factor. Designed for hybrid

environments, the virtual version of FortiWeb includes protection for container-based applications. FortiWeb VM can be deployed in

VMware, Microsoft Hyper-V, Citrix XenServer, Open Source Xen, VirtualBox, KVM, and Docker platforms.

Advanced Protection

Using the multilayered and correlated approach of a full enterprise-class WAF FortiWeb Cloud WaaS protects web applications from

the OWASP Top 10 threats 5

and more. Specifically, FortiWeb Cloud WaaS safeguards applications from vulnerability exploits, bots,

malware uploads, distributed denial-of-service (DDoS) attacks, advanced pers istent threats (APTs), and zero-day attacks.

A significant pain point associated with many WAF solutions is the large number of false positives, which can add manag

ement overhead

for busy DevOps staff and increase the chances that a real vulnerability is left undetected. However, FortiWeb Cloud WaaS uses machine

learning (ML)-enabled technology to minimize false positives while accurat ely identifying real threats. Botnets, Malicious Hosts, Anonymous Proxies, DDoS SourcesIP Reputation

Application-Level DDoS AttacksDDoS Protection

Improper HTTP RFCProtocol Validation

Known Application Attack TypesAttack Signatures

Viruses, Malware, Loss of DataAntivirus/DLP

FortiGate and FortiSandbox APT DetectionIntegration Scanners, Crawlers, Scrapers, Credential StuffingAdvanced Protection Unknown Application Attacks with Machine LearningBehavioral Validation

Attacks/ThreatsApplication

Correlation

User/Device Threat Scoring

Figure 2: Common attack vendors and remediation techniques.

Easy to Deploy and Manage

FortiWeb Cloud WaaS enables rapid application deployments in the public cloud while addr essing compliance standards and protecting

business-critical web applications. To facilitate use by nonsecurity professionals, FortiWeb Cloud WaaS comes with a setup wizard and a default

, and certain other marks are registered trademarks of Fortinet, Inc., and other Fortinet names herein may also be registered and/or common law

trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other

results may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all wa

rranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed

by Fortinet's General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in

such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on

Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal con

ditions as in Fortinet's internal

lab tests. Fortinet disclaims in full any covenants, representations, and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most

current version of the publication shall be applicable. Fortinet disclaims i

n full any covenants, representations, and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this

publication without notice, and the most current version of the publication shall be applicable. www.fortinet.com

October 16, 2019 8:58 PM

D:\Fortinet\Solution Briefs\blue solution briefs\Fortinet Cloud Architect\sb-fortinet-cloud-architect-v2

442663-0-A-EN

SOLUTION BRIEF | Cloud-native Solution for Web Application Security: FortiWeb Cloud WAF-as-a-Service

Conclusion

Utilizing a comprehensive, correlated, multilayer approach to web application security, FortiWeb Cloud WaaS protects web-based

applications from all of the Top 10 OWASP security risks and many more. Unique among WAFs on the market, FortiWeb

Cloud WaaS

leverages ML capabilities to detect both known and unknown exploits targ eting web applications with almost no false positives.

Delivered

via a cloud platform such as Azure or AWS, FortiWeb Cloud WaaS features low latency and high elasticity and can easily and quickly scale

to accommodate changes in traffic. Further, FortiWeb Cloud WaaS keeps web applications safe from vulnerability exploits, bots, malware

uploads, DDoS attacks, APTs, and zero-day attacks. 1 "Shared Responsibility Model," AWS, accessed June 20, 2019. 2 "2018 Data Breach Investigations Report," Verizon, accessed June 18, 2019. 3 Ibid. 4 Ibid. 5

"OWASP Top 10-2017: The Ten Most Critical Web Application Security Risks," OWASP, accessed May 25, 2018.

Cost-effective Security

As a cloud-native SaaS solution, FortiWeb Cloud WaaS features lower capital expenditures (CapEx) and operational expenditures (OpEx) compared

to on-premises solutions. The cloud provider such as Azure or AWS provides the hardware and software components of the infrastructure, virtually

eliminating the need for capital investments as well as the operating co sts associated with platform maintenance. By removing the burden of

maintaining and upgrading the platform, customers can focus on improving the application and delivering business value to their organizatio

ns. The SaaS business model - pay only for what you use - gives customers flexibility in managing their security budgets as well as the ability to institute chargebacks and other cost-control measures.

Figure 3: FortiWeb Cloud WaaS dashboard.

FortiWeb Cloud WaaS delivers cloud-native application security that can be deployed in m inutes. After going through the setup wizard, simply update your DNS setting and your web application is protected.

Busy DevOps staff have no time for extensive WAF training. To address this issue, FortiWeb Cloud WaaS features an intuitive real-time

dashboard that allows DevOps staff and other nonsecurity professionals to see and understand quickly the security status of their w

eb applications (Figure 3).quotesdbs_dbs14.pdfusesText_20

[PDF] Cloud-native Solution for Web Application Security: FortiWeb Cloud