Environment Support To be effective the WAF has to work well in your environment. The following section describes aspects of a WAF required to support your environment. It is split into [two] sections. The first describes the options for deployment and the requirements your organization might have regarding those options and the impact to the environment. The second aspect is the support offered for the elements of the target environment. This further includes 2 aspects, support for protected applications support for environment options and ability to implement environment options. [MK: The example here is support for various authentication options vs. implementation of those options.] Evaluation guidelines: unless described otherwise, for each criteria group below select and evaluate only the criteria that are relevant to your organization. Keep in mind that requiring unneeded criteria may lead to higher cost and complexity in the solution selected. Deployment Model Packaging Packaging is often a matter of corporate culture and usually does not have significant effect on the quality of the solution. Verify that the WAF supports the packaging method your organization prefers. Note that method of delivery will limit the deployment architecture options available and vice versa. Delivery Description Deployment Architecture Method Options A. Appliance Software bundled with hardware. Appliances are usually Reverse Proxy highly optimized and may contain specialized hardware Transparent Proxy components to increase performance (e.g. SSL Transparent Bridge processors), availability (e.g. “fail-open” network Non-inline interfaces) or perform other specialized functions (e.g. Lights-Out Management, or “LOM”, interfaces. B. Virtual WAF is delivered as software packaged as an installable Reverse Proxy Appliance virtual instance for a specific hypervisor, e.g an .OVF file Transparent Proxy for VMWare ESX. Often a specific minimum configuration Transparent Bridge of resources (memory, disk, etc.) is required. Non-inline C. Software WAF is delivered as an application that can be installed Reverse Proxy on a generic computer. Often a specific reference Transparent Proxy configuration of hardware and operating system is Transparent Bridge required. Non-inline Embedded D. Software The WAF is provided to the user as a service. In this Reverse Proxy as a scenario the physical delivery model for the software can Transparent Proxy Service be hidden from the user. This model is typical for (SaaS) ”Cloud” models, but can also be relevant in hosted environments or even for on-premise deployments managed by a managed service provider.
Environment Support To be effective the WAF has to work well in your environment. The following section describes aspects of a WAF required to support your environment. It is split into [two] sections. The first describes the options for deployment and the requirements your organization might have regarding those options and the impact to the environment. The second aspect is the support offered for the elements of the target environment. This further includes 2 aspects, support for protected applications support for environment options and ability to implement environment options. [MK: The example here is support for various authentication options vs. implementation of those options.] Evaluation guidelines: unless described otherwise, for each criteria group below select and evaluate only the criteria that are relevant to your organization. Keep in mind that requiring unneeded criteria may lead to higher cost and complexity in the solution selected. Deployment Model Packaging Packaging is often a matter of corporate culture and usually does not have significant effect on the quality of the solution. Verify that the WAF supports the packaging method your organization prefers. Note that method of delivery will limit the deployment architecture options available and vice versa. Delivery Method Description Deployment Architecture Options A. Appliance Software bundled with hardware. Appliances are usually highly optimized and may contain specialized hardware components to increase performance (e.g. SSL processors), availability (e.g. “fail-open” network interfaces) or perform other specialized functions (e.g. Lights-Out Management, or “LOM”, interfaces. Reverse Proxy Transparent Proxy Transparent Bridge Non-inline B. Virtual Appliance WAF is delivered as software packaged as an installable virtual instance for a specific hypervisor, e.g an .OVF file for VMWare ESX. Often a specific minimum configuration of resources (memory, disk, etc.) is required. Reverse Proxy Transparent Proxy Transparent Bridge Non-inline C. Software WAF is delivered as an application that can be installed on a generic computer. Often a specific reference configuration of hardware and operating system is required. Reverse Proxy Transparent Proxy Transparent Bridge Non-inline Embedded D. Software as a Service (SaaS) The WAF is provided to the user as a service. In this scenario the physical delivery model for the software can be hidden from the user. This model is typical for ”Cloud” models, but can also be relevant in hosted environments or even for on-premise deployments managed by a managed service provider. Reverse Proxy Transparent Proxy
WAFEC_2_Environment_Support.docx