7 ms·
Some web application firewalls have better telemetry, monitoring, notification, etc. than the services behind them, especially for unsophisticated attacks. Als
by idorosen 5y ago
Some web application firewalls have better telemetry, monitoring, notification, etc. than the services behind them, especially for unsophisticated attacks. Also, any attacker filtered is one less connection wasting resources on the hosts running your actual services, leaving more CPU and memory to handle legitimate requests on application servers.
None of them defend against everything, and there is an important nugget in your post: “defense in depth.” You should also filter requests that make it through the WAF. But, getting rid of even 90% of bogus requests before they hit your app servers seems worthwhile.
- GauntletWizard 5y agoThose are all nice to have, but that's called a load balancer. It should also have rate limiting and DOS protection, and I use the AWS WAF for those things, and don't really care that they're in a separate feature and that that feature is misnamed. For every defense in depth, there's an org that's put up a WAF rule in front of an unpatched application and called it good, only yo be owned days later. False sense of security is the thing to stress here, because there is no depth.