7 ms·

People will stop deploying WAFs when the compliance standards are rewritten to not require them. They are prominent in lots of installations because the box tic

People will stop deploying WAFs when the compliance standards are rewritten to not require them. They are prominent in lots of installations because the box ticking exercise of compliance frameworks, namely PCI or HIPAA, require a WAF-like component to reach compliance. It took long enough for them to be written in that now everyone knows they need one. It will be even longer for them to be phased out, and no one with risk assessors wants to be the first to remove them. Too much risk they say, regardless of how strenuously the tech component say they're unneeded.

briffle 3y ago
We are still waiting on compliance standards to update their password change policies to reflect what most people have been saying for over a decade, that frequently changing passwords are a security risk..
- kibwen 3y ago
  NIST itself has been actively discouraging password rotation since 2016: https://pages.nist.gov/800-63-3/sp800-63b.html#memorizedsecrets https://pages.nist.gov/800-63-3/sp800-63b.html#memorizedsecr...
  - rjzzleep 3y ago
    But then how will Cyberark make money?
  - Arrath 3y ago
    I expect you have 3M lobbying on the other side of the issue in the interest of post-it sales.
  - dmvdoug 3y ago
    I am so sending this to our district IT people the next time they make us change our passwords at school.
  - jwestbury 3y ago
    NIST discourages it, but most of the US government still requires it. In fact, I used to have a 60-day password rotation policy with such brilliant requirements as "no more than three characters of one class sequentially." I soon realised that "ShitFuck!", thus, was a valid password -- and off I went. Meanwhile, a teammate who had previously been a technical writer contracting with the NSA told of the "waterfall method" -- not of software developments, but of passwords. It was common in his world, apparently, and you could always hear he was typing his password by the staccato of QazWsxEdc123, etc.
    - justsomehnguy 3y ago
      It's always amuses me what a domain name with a number in it ticks '3 of 4'.
- rwmj 3y ago
  The PCI-DSS website itself requires that you change password every 12 months. At the same time the period for recertifying PCI-DSS is ... every 12 months. I have a systematic way to create a new password each time, which probably isn't secure.
  - geraldwhen 3y ago
    I have to rotate my password at work every 3 months. Without a system, it wouldn’t be sustainable.
- junon 3y ago
  Got into a quarrel about this with our IT director at a previous company. I wish there was a security best practices FAQ I could link to for this sort of stuff.
  - placatedmayhem 3y ago
    As a peer post of yours pointed out, NIST changed guidance to discourage password changes years ago: https://pages.nist.gov/800-63-3/sp800-63b.html#memorizedsecrets https://pages.nist.gov/800-63-3/sp800-63b.html#memorizedsecr...
jiggawatts 3y ago
I call it magic security pixie dust. You sprinkle it on top of code riddled with SQL injections nobody could be bothered to avoid or fix, and now magically the code has a become secure! You’ll find it on the shelf next to auto-scaling cloud wizardry, which can similarly be used to fix the total absence of indexes in the database.
- threeseed 3y ago
  1) WAF do far more than just prevent SQL injections. 2) Many companies don't own the software they run and so they can't guarantee that it is free of SQL injections or that the version of ORM libraries are secure. WAF protect against this. 3) Auto-scaling is just as much about high availability than performance. Database indexes do not help with the former.
  - SonOfLilit 3y ago
    I did not downvote you, but as the article explains, WAFs don't protect against anything assuming the attacker bothers to spend five minutes bypassing them with one of a thousand well-known tricks.
    - threeseed 3y ago
      > assuming the attacker bothers to spend five minutes bypassing them with one of a thousand well-known tricks I didn't realise AWS, Cloudflare etc were so incompetent that their product can be bypassed in 5 minutes. I assume you have an example of this.
      - verve_rat 3y ago
        Padding requests with 8k of normal looking data will bypass AWS's WAF 100% of the time according to the article. Maybe you should read it.
        woleium 3y ago
xyzzy123 3y ago
> People will stop deploying WAFs when the compliance standards are rewritten to not require them. Honestly AWS WAF is perfect for this. It's not a great WAF but it is ideal if you need "pretend to have a WAF" as a service so you can tick the box.
- theideaofcoffee 3y ago
  As much as I hate to admit it, I've done exactly that and passed the audit. Certainly says a lot about the auditors...
  - ryanianian 3y ago
    It's basically fizzbuzz. If you have a WAF, it proves you know how to add a WAF. Presumably even one you know how to configure when security needs change. Compliance auditors are mostly there to underwrite posture, not actual risk.
    - SoftTalker 3y ago
      Auditors pretty much only certify that you have told them you are doing what you are supposed to be doing. They are not logging in to your servers and verifying that an AWF is running in front of your web server. They are not probing your network from the outside to see if an AWF is blocking their activity. Just as financial auditors are only confirming that your financial statements match what your accounting department tells them. If you lie to your auditors, there's a good chance they won't catch it because that's not what they are looking for.
      - xyzzy123 3y ago
        It's not a lie! The WAF is there, it's attached and it does absolutely nothing with unmatched performance and scalability. We tell the auditor this. There's no audit checkbox for "WAF actually does something useful", so it's fine.
      - kccqzy 3y ago
cratermoon 3y ago
The article notes the problem of the attack surface of WAF products themselves, and raises questions about the security posture of the products and the vendors. Compliance standards need to address the risks and weigh them against the benefits of WAFs. If, as the author argues, they have reached a point where they do more harm than good, the compliance bodies need to be honest about that and reevaluate recommendations.
- patrakov 3y ago
  Here is a big lesson that I "learned": actual security does not matter for the purpose of avoiding risks and fines. What matters is the ability to say "we got hacked despite following the accepted best practice" or "we can shift the blame HERE". Having a paid-for WAF ticks both boxes.
  - cratermoon 3y ago
    > actual security does not matter What matters, of course, is money. Only if the WAFs themselves become a significant attack vector, to the extent where blame for breaches affects the bottom lines of the WAF vendors, the situation will start to change.

briffle 3y ago

We are still waiting on compliance standards to update their password change policies to reflect what most people have been saying for over a decade, that frequently changing passwords are a security risk..

kibwen 3y ago
NIST itself has been actively discouraging password rotation since 2016: https://pages.nist.gov/800-63-3/sp800-63b.html#memorizedsecrets https://pages.nist.gov/800-63-3/sp800-63b.html#memorizedsecr...
- rjzzleep 3y ago
  But then how will Cyberark make money?
- Arrath 3y ago
  I expect you have 3M lobbying on the other side of the issue in the interest of post-it sales.
- dmvdoug 3y ago
  I am so sending this to our district IT people the next time they make us change our passwords at school.
- jwestbury 3y ago
  NIST discourages it, but most of the US government still requires it. In fact, I used to have a 60-day password rotation policy with such brilliant requirements as "no more than three characters of one class sequentially." I soon realised that "ShitFuck!", thus, was a valid password -- and off I went. Meanwhile, a teammate who had previously been a technical writer contracting with the NSA told of the "waterfall method" -- not of software developments, but of passwords. It was common in his world, apparently, and you could always hear he was typing his password by the staccato of QazWsxEdc123, etc.
  - justsomehnguy 3y ago
    It's always amuses me what a domain name with a number in it ticks '3 of 4'.
rwmj 3y ago
The PCI-DSS website itself requires that you change password every 12 months. At the same time the period for recertifying PCI-DSS is ... every 12 months. I have a systematic way to create a new password each time, which probably isn't secure.
- geraldwhen 3y ago
  I have to rotate my password at work every 3 months. Without a system, it wouldn’t be sustainable.
junon 3y ago
Got into a quarrel about this with our IT director at a previous company. I wish there was a security best practices FAQ I could link to for this sort of stuff.
- placatedmayhem 3y ago
  As a peer post of yours pointed out, NIST changed guidance to discourage password changes years ago: https://pages.nist.gov/800-63-3/sp800-63b.html#memorizedsecrets https://pages.nist.gov/800-63-3/sp800-63b.html#memorizedsecr...

jiggawatts 3y ago

I call it magic security pixie dust. You sprinkle it on top of code riddled with SQL injections nobody could be bothered to avoid or fix, and now magically the code has a become secure! You’ll find it on the shelf next to auto-scaling cloud wizardry, which can similarly be used to fix the total absence of indexes in the database.

threeseed 3y ago
1) WAF do far more than just prevent SQL injections. 2) Many companies don't own the software they run and so they can't guarantee that it is free of SQL injections or that the version of ORM libraries are secure. WAF protect against this. 3) Auto-scaling is just as much about high availability than performance. Database indexes do not help with the former.
- SonOfLilit 3y ago
  I did not downvote you, but as the article explains, WAFs don't protect against anything assuming the attacker bothers to spend five minutes bypassing them with one of a thousand well-known tricks.
  - threeseed 3y ago
    > assuming the attacker bothers to spend five minutes bypassing them with one of a thousand well-known tricks I didn't realise AWS, Cloudflare etc were so incompetent that their product can be bypassed in 5 minutes. I assume you have an example of this.
    - verve_rat 3y ago
      Padding requests with 8k of normal looking data will bypass AWS's WAF 100% of the time according to the article. Maybe you should read it.
      - woleium 3y ago

xyzzy123 3y ago

> People will stop deploying WAFs when the compliance standards are rewritten to not require them. Honestly AWS WAF is perfect for this. It's not a great WAF but it is ideal if you need "pretend to have a WAF" as a service so you can tick the box.

theideaofcoffee 3y ago
As much as I hate to admit it, I've done exactly that and passed the audit. Certainly says a lot about the auditors...
- ryanianian 3y ago
  It's basically fizzbuzz. If you have a WAF, it proves you know how to add a WAF. Presumably even one you know how to configure when security needs change. Compliance auditors are mostly there to underwrite posture, not actual risk.
  - SoftTalker 3y ago
    Auditors pretty much only certify that you have told them you are doing what you are supposed to be doing. They are not logging in to your servers and verifying that an AWF is running in front of your web server. They are not probing your network from the outside to see if an AWF is blocking their activity. Just as financial auditors are only confirming that your financial statements match what your accounting department tells them. If you lie to your auditors, there's a good chance they won't catch it because that's not what they are looking for.
    - xyzzy123 3y ago
      It's not a lie! The WAF is there, it's attached and it does absolutely nothing with unmatched performance and scalability. We tell the auditor this. There's no audit checkbox for "WAF actually does something useful", so it's fine.
    - kccqzy 3y ago

cratermoon 3y ago

The article notes the problem of the attack surface of WAF products themselves, and raises questions about the security posture of the products and the vendors. Compliance standards need to address the risks and weigh them against the benefits of WAFs. If, as the author argues, they have reached a point where they do more harm than good, the compliance bodies need to be honest about that and reevaluate recommendations.

patrakov 3y ago
Here is a big lesson that I "learned": actual security does not matter for the purpose of avoiding risks and fines. What matters is the ability to say "we got hacked despite following the accepted best practice" or "we can shift the blame HERE". Having a paid-for WAF ticks both boxes.
- cratermoon 3y ago
  > actual security does not matter What matters, of course, is money. Only if the WAFs themselves become a significant attack vector, to the extent where blame for breaches affects the bottom lines of the WAF vendors, the situation will start to change.