Evidence of this can be seen in most major security related forums, such as bugtraq or ntbugtraq . Exploits are released for services everyday, sometimes before the vendor has a chance to provide a fix for the problem. There is also a large degree of underground activity, and some security problems are only found after having been actively used, sometimes for months, before they are noticed and released to the proper channels. Enter the Application Firewall With the understanding that there are problems in the traditional model of protecting networks comes a new paradigm for securing specific services. It is not meant to be a replacement for Firewalls and IDS, but instead will be a complementary technology.
Application firewalls are systems designed to protect specific services from attack.
At its basest form, an application firewall is a reduced application that allows filtering of input for a specific service to allow only desired input. By defining what is acceptable and what is not, it can abort abnormal sessions of a protocol and stop them from continuing on to the actual application. If implemented correctly, this technique can stop not only specific vulnerabilities, but also general classes of vulnerabilities. This allows the application firewall to protect against new vulnerabilities before they are found and exploited. This philosophy should be implemented in service design, but rarely is.