4 ms·
WAFs seem to be pretty universally regarded as garbage by the security professionals I know. - there’s a (closed source for F5) black box that’s gonna mess wit
by jitl 8y ago
WAFs seem to be pretty universally regarded as garbage by the security professionals I know.
- there’s a (closed source for F5) black box that’s gonna mess with some of your requests
- it might block legitimate requests that “look” like SQL injection attempts (false positives)
- a WAF adds a bunch more latency to your request/response cycle
- malicious requests will still get through the WAF (false negatives), so it’s not like you can just forget about application security after you set one up
- detaro 8y agoI think a big problem is the advertised idea that a WAF can be "turn-key" and effective with defaults, which just doesn't work, + quality issues with at least some offerings. Making a WAF truly effective means to understand what actual traffic for the application looks like, and building a profile around that. Which is a lot more effort, and might mean the effort is better invested into other hardening measures.
- sebazzz 8y agoSecurity is built on layers. A WAF is just another layer. Just like obscurity. Security is not done only through obscurity, but obscurity van increase security.