NT OBJECTives has announced its NTODefend software for enterprise security teams to create "perfect-fit" custom rules to patch Web Application Firewalls (WAF) or Intrusion Prevention System (IPS) against web application vulnerabilities discovered in automated scans carried out by its NTOSpider product.

The company says that security teams are discovering application vulnerabilities, but in the time it takes for a security to notify the development team that a code fix is needed, a site can be defaced, taken down, or have customer data stolen. For this reason, says NT OBJECTives, organizations need to rely on WAFs to protect their web applications while developers are fixing the code, when the third-party code cannot be accessed, or when the code is simply outdated.

"With NTODefend, enterprise security teams now have the ability to customize and train their WAFs/IPSs to be optimally effective at protecting applications in production, while eliminating the difficulties, costs, and risks associated with traditional manual methods of training these technologies," said Dan Kuykendall, co-CEO and CTO of NT OBJECTives. "The various application security vendors must continue to work together to deliver innovation that helps organizations protect applications already in production more effectively."

This problem here is that very few enterprise security teams actually have time to properly train their WAFs to provide the necessary protection, leaving applications and enterprises vulnerable to an ever-changing landscape of threats. Additionally, as has been the case with IPS deployment, enterprises are concerned that active defensive devices will block good traffic. While WAF and IPS devices include standard rules designed to block vulnerabilities, they lack the specific knowledge of the applications that they are supposed to protect. As such, the included packaged rules are one-size-fits-all and are less effective than rules that are designed to work specifically for that application.