First, a firewall is designed to prevent intrusion on a computer’s hard drive, but is not meant to protect a company’s web site. For that, a WAF, or web application firewall, is a server plugin, appliance or filter that applies a set of rules to an HTTP conversation aimed at deterring web site hacks. By customizing rules to one’s application, cyberattacks can be identified and blocked.

According to Jake Kromer, the Director of Technical Support for LawLytics, Inc., an Arizona-based legal marketing firm, the difference between a firewall and a WAF is how they are coded. Those deviations allow them to perform different tasks. That’s not to say, however, that a firewall can’t secure a web site. “A firewall would protect a web site as long as you have access to the firewall itself,” he says.

“A firewall allows a person to enter this ‘door’ and limits entrance to certain people,” says Kromer.

Web sites created on servers like GoDaddy already have a WAF installed in them. However, if you create your web site on your own server, then the inclusion of a WAF is up to you.

Don’t pass on password protection
Common firewalls, like Kaspersky, are useful in certain situations, but, according to Kromer, most hackers don’t worry about cracking passwords. Instead, Kromer advises business owners to improve their password protection practices.

For example, when a web site asks a user to answer default questions so a forgotten password can be recovered, Kromer says it’s wise to provide false answers. Of course, it is imperative the user remembers the false answers they provided, but, barring that, this practice is an excellent and simple way to improve password protection.

---

Tami Kamin Meyer is an Ohio attorney and writer.