Where does it fit in the overall architecture?

webApp.secure™ sits behind the Internet-facing perimeter defenses (firewalls, IPS/IDS, etc.) and in front of the Web environment (IIS, Apache, WebSphere®, etc.).

Does it have to run on the Web server?

No, webApp.secure operates as a reverse-proxy and can therefore run on the same machine as the Web server, but also gives the flexibility to run on a separate machine.

What are some deployment options?

webApp.secure can be deployed as software directly onto the Web server, on a dedicated server (vanilla x86 hardware), or as an appliance - either single-purpose or as part of a unified threat management platform (contact us for details).

What are "Intended Use Guidelines"?

Intended Use Guidelines refer to the "rules" extracted from content (HTML, JavaScript, Flash) as it leaves the Web environment. Within the context of a positive protection model, Intended Use Guidelines represent a "white list".

Is a "re-training" process required when the website is updated?

No, the Intended Use Guidelines are updated in real-time based on the content of the site. Changes are automatically recognized.

Does the Professional Edition meet PCI 6 requirements?

Yes, the comprehensive application protection provided by webApp.secure PE satisfies PCI 6.6 compliance requirements.

Beware of "pretenders" that claim PCI 6 compliance, but do nothing more than rudimentary HTTP protocol inspection. These products have no ability to stop SQL injection, cross-site scripting, or other sophisticated application-manipulation attacks that concern the Payment Card Industry Security Standards Council (PCI Security Standards.org).

Do I need to train or certify my staff?

No, webApp.secure was designed from the ground up to be as easy to use as it is effective. Unique functionality of webApp.secure makes it very intelligent and automatic, which dramatically reduces installation and on-going administration costs/efforts.