I have a server behind a firewall. It runs a web application (Java servlets under Apache Tomcat) and responds only to port 443 (HTTPS). There is no scripting code in the pages served – the forms use HTTP POST to receive the form, process the data (with appropriate input filtering) and then output an HTTP result page.
I am currently using an appliance firewall, but it is ‘hardware-flakey’. I have been looking at upgrading to a more ‘industrial strength’ solution, but the vendor is quite insistant that I purchase a subscription to their ‘deep packet inspection’ software. He claims that even web servers need this kind of protection.
I am not convinced, but do not have the security background to be certain. The firewall would sit between the ‘world’ and my server, and use ‘port forwarding’ to allow only ports 443 and 22 (for maintenance) to reach the server.
So – do I really need this deep packet inspection, or not?
Given that the only protocols that you’re interested in (ssh and https) are ‘negotiate encryption on connect’ there’s little that a standard firewall will be able to inspect after that point. Once the SSL/SSH session is established the firewall will only see encrypted packets. Ask your vendor what their product examines in this context.
Alternatively, it is possible that the device acts more like a proxy — that it acts as the server-side end-point for the connection before relaying on to your real server — in which case it is possible that the product does something deeper, although this isn’t the case if the firewall really is ‘port forwarding’ as you say. Again, your vendor should be able to explain how their device operates.
Also you may want to ask what vulnerabilities/risks the inspection system is intended to protect against. For example: Does it look out for SQL injection? Is it targetted to a particular platform? (If your web server runs on a SPARC CPU, for example, then there’s little point inspecting URLs for x86 shellcode).