The Payment Card Industry Data Security Standard ver. 1.1 requires that all web facing applications are protected against known attacks either by installing an application layer firewall or by having all custom application code reviewed by application security specialists.
The new requirement places a heavy burden on many online retailers, especially the smaller ones, as either of the alternatives are expensive with the application layer firewall solution being "cheapest" costing €40,000 and up for an automated redundant solution.
The high price tag has placed many companies in a dilemma: Review does not fix any problems, it just identifies them. So the real price tag of the review option is the cost of fixing application vulnerabilities and subsequently having web applications reviewed (again..). The application layer firewall option on the other hand removes the symptoms (the vulnerabilities)
With deadlines rapidly approaching and other business and compliance tasks to see to many companies are forced to take the application firewall route. This is why web application firewalls are very expensive.
Armorlogic has chosen a different pricing model than the competition. They are offering their web application firewall product Profense for free leaving resources for fixing application vulnerabilities. So how are they going to make money? "We provide the software free of charge with a limited support package which does not include inline installation of updates and prioritized support. To get the reasurrance of prioritized incident response and the convenience of not having to re-install when updates are available customers can buy an upgrade of their support package at our web site." says Jakob Gercke, CEO of Armorlogic.
Unlike most competing alternatives Profense is a software appliance. It includes a hardened OS and installs on most standard hardware, including virtual platforms. A major advantage of the software appliance model is that it offers lower cost of disaster preparedness and recovery. If disaster strikes all that is needed to restore the system is a backup and a piece of general purpose server hardware. For competitors appliance based solutions a new expensive specialized piece of hardware have to be procured or kept standby off-site.
ISO images and free software licenses are available from http://www.armorlogic.com.
