I spoke with James Spooner of Secerno and Bill Beverley of F5 Networks about their solution, which is based around the F5 BIG-IP ASM and Secerno DataWall products. Essentially they are working together to provide a more joined up security solution. While much has happened to deliver more integration between the lower network levels and applications, no-one has really tackled the problem of integrating application and database security – at least not in the web application space.

This is where F5 Networks and Secerno have jointly focussed their effort. By using customized rules on the F5 box, DataWall can be notified of anomalies at the web traffic layer. This gives Secerno’s product user-level visibility (down to the session level) of what is happening in web applications. In theory this approach should increase the ability to protect back-end databases, and reduce the number of false positives. 

The F5 BIG-IP provides more than half a dozen attributes that can be used to correlate web transactions to database transactions, enabling very granular blocking of attempts to exploit SQL security vulnerabilities (see here). Suspicious activity can be reported up to SIM/SEM security management products and used for security forensics.

It is an interesting development, with lots of potential for expanded functionality. Using web-based applications is an attractive way of sharing information outside of the organization, either via Web 2.0 style APIs, or web portals. They can be quick to develop, and provide efficiency and competitive advantage. The downside is that such applications often require access into databases with sensitive information. The F5 and Secerno solution is a worthy attempt to deliver high levels of security, but still enable business flexibility – making both companies’ solutions more attractive.

Related Posts

• Identity Management
• F5 Networks – A Case of Applications and the Network
• When Blurred e-mail Goes From Bad to Worse

Talking earlier this month with Bill Beverley, Security Manager at F5 Networks, F5′s focus is clear: “deploying applications is really the central role of IT”. That’s certainly part of it. Keeping them up and running is too, and that has been bread and butter business for F5, delivering kit to put in front of servers to deal with the peaks in capacity and inevitable server failures.

Load balancing provides availability, but acceleration and optimization are also key in today’s infrastructures. That has made WAN optimization a hot area, especially now that bandwidth prices are no longer falling rapidly. Bill talked about how F5 are adding extra layers of security for web applications, something that is big in PCI and compliance driven environments. F5 see their solutions as complementary to the network firewalls, with the firewall dealing with the high-load, low-intelligence packet filtering. As Bill was keen to point out, “if you have a really efficient smaller piece of kit doing that job, then we can deal with traffic in an effective and more intelligent way.”

F5 boxes terminate the TCP connection and then regenerate it out of the other side. Since the devices have application-level visibility into the application streams, this is the perfect place to apply application acceleration and application security magic. However, this isn’t going to be a clean battle. The traditional firewall players like Cisco, Juniper Networks and Checkpoint, are keen for a piece of the action too.

A battle is brewing between the folks coming from the application towards the network, and the network folks heading up the stack to optimize applications. On the application side, F5 might be the baby gorilla, but there are a number of chimps ready to fight it out with them. Database security has seen specialist players like Secerno emerge. In talking to Bill about SQL security, his comment was “I think you will see consolidation in that area.” I wouldn’t take that as a statement that F5 is feeling acquisitive (although they have been), but rather that smaller players will get swept up or washed away in the coming quarters.

Hosting and data centres are becoming more and more sophisticated environments, as you can see from the diagram. Layers have been added to the network to provide security, then availability, and now application acceleration. Those layers are spreading in their functionality too, with SSL VPN being added to the security layer, and storage virtualization added into availability. The latter will help many IT managers to clear up the NAS(ty) mess on the network, by balancing across multiple NAS devices, and migrating data at rest to slower storage devices.

F5 solutions are purchased as a mixture of sticking plaster remedies and strategic design, where acceleration and availability are part of the fundamental architecture, rather than an add on when capacity gets exceeded. F5 have some interesting developments coming down the line in the virtualization space. Because they see the application performance, then can provide feedback into VMotion / ESX running on the servers, to tell it to provision extra servers or deprovision them. The integration works through SNMP and SYSLOG, so could potentially be open to other vendor combinations too. Certainly lots for F5′s channel partners to apply their expertise to.

Related Posts

• VoIP Still a Two Horse Race
• Collaboration and Unified Communications – TechwiseTV
• Linking Network and Database Security