3 ms·
This, I’d rather not use a waf and focus on making sure that application security is good. A waf is at best as good as AV, good as a catch all, but it won’t ca
by hsbauauvhabzb 4y ago
This, I’d rather not use a waf and focus on making sure that application security is good.
A waf is at best as good as AV, good as a catch all, but it won’t catch highly targeted stuff, and isn’t even a defensible boundary to protect the former.
- chrisshroba 4y agoWhat does AV mean in this context?
- deleted 4y ago[deleted]
- ShowalkKama 4y agoantivirus
- brodock 4y agoWAF is mandatory in some certifications.
- hsbauauvhabzb 4y agoYes but so safe lots of silly controls. The best part of a waf is the ability to add custom rules at runtime which can assist in blocking known vulnerabilities until they are remediated correctly. I don’t think generic sql or XSS injection rules are at all effective not stop many real world attacks. I’ve also seen wafs create both an availability failure point, dos choke point, and be the most vulnerable product in the tool chain (see F5 code exec vulns).