Four security software rivals are have teamed up to set a baseline standard for application security firewalls, challenging others in the industry to join them.

At the Computer Security Institute's Annual Security Conference, F5 Networks, Imperva, NetContinuum, and Teros announced the Application Security Consortium, saying the group wanted to establish minimum standards for application security software through independent testing.

One of the goals of the program is to improve protection for underlying software protocols and application code in Web applications, according to a statement released by the group. They have invited other security software vendors, including Symantec, McAfee, Cisco Systems, Juniper Networks, and Check Point Software Technologies, to join the group and have their software tested by an independent lab.

The group formed last month after discussions among three of the vendors found that they all felt customers did not have sufficient criteria to judge their products.

Working with ICSA Labs, a subsidiary of TruSecure, the group came up with five criteria for the minimum standards. According to the group, an application firewall must detect and block application inputs containing malicious code, prevent attempts to insert illegal data types into applications, block attempts to modify application cookies, prevent attempts to modify application form fields, and stop attempts to modify URL parameters.

"We felt like this was a good basis for comparison, even if it is just a minimum standard," said Gene Banman, CEO of NetContinuum. Banman said companies that are looking to find application security tools need some way to measure the different tools available.

According to a recent Yankee Group study, application security will grow to be a US$2 billion market over the next five years.

"Web applications often link directly to sensitive business data, making them a prime target for hackers intent on stealing financial and identity data," said Jim Slaby, a senior analyst at The Yankee Group. "Open initiatives by vendors to self-regulate their industry benefit customers by helping establish minimum baselines for comparing security products and sorting through sometimes confusing marketing messages," he said.