Conventional Protection Isn’t Enough. - Why?

To answer this question, it is helpful to look at the technical basis of Internet communication; we have chosen the infrastructure of a typical e-business:

The requests of Internet users are checked by the service provider with conventional security measures such as firewalls, reverse proxy and intrusion detection systems before the web server passes them on to the application.

Typically, this request is analyzed for potential attacks on its way from the client to the backend system as follows: 

As the illustration above clearly shows, the business logic layer, possibly with the exception of simple pattern recognition by IDS/IPS, reverse proxy servers or deep inspection firewalls, is not sufficiently analyzed.

• For historical reasons, the mentioned security systems were developed to protect the lower so-called transport layers – where they perform a great job.
• In the end, every web application uses HTTP only to transport a logic that is specific to the application. This means that each application has to be protected in a specific way.

• Important data are often SSL-secured and then transported, which means that conventional IT security solutions have a hard time analyzing them.

To put it simply:

• The web applications speak a language that firewalls, reverse proxy servers and IDS or IPS systems do not understand.

Additionally, the multiplicity of available web script languages, application frameworks and web technologies create almost innumerable security gaps.

An ideal situation for hackers.