5 ms·
> setting up a WAF tool designed to help 10,000 employee insurance companies What's wrong with that use case though? If you get hired as the new CTO, you're no
by Alex3917 9y ago
> setting up a WAF tool designed to help 10,000 employee insurance companies
What's wrong with that use case though? If you get hired as the new CTO, you're not even going to know all the managers, let alone all the developers.
Clearly auditing all code, doing developer training, etc. is the right longterm approach. But putting a security culture in place and actually getting things right in this kind of environment is a multi-year process.
- tptacek 9y agoThere's nothing wrong with that use case. I don't love WAFs really in any setting --- I tend to agree with the security nerds I hang out with who call it "the AV of appsec" --- but at least it makes sense in that context. I'm writing for an audience of people whose businesses own the applications they're deploying. If you control code, you should have at least the security staff required to cut out the extremely low-hanging fruit attack surface that things like WAFs address. Most startups, even with 20+ developers, don't have any full-time security people, and that's fine, because even at the ~20 engineer scale, it's still perfectly feasible to cut out all the WAF-addressed attack surface for your environment. On rare occasions I'll write advice or give an answer from the perspective of enterprise secops, but unless I say I'm doing that, I'm never really writing from the enterprise perspective. Reddit r/netsec is the right place for that POV.