3 ms·

> People will stop deploying WAFs when the compliance standards are rewritten to not require them. Honestly AWS WAF is perfect for this. It's not a great WAF b

> People will stop deploying WAFs when the compliance standards are rewritten to not require them. Honestly AWS WAF is perfect for this. It's not a great WAF but it is ideal if you need "pretend to have a WAF" as a service so you can tick the box.

theideaofcoffee 3y ago
As much as I hate to admit it, I've done exactly that and passed the audit. Certainly says a lot about the auditors...
- ryanianian 3y ago
  It's basically fizzbuzz. If you have a WAF, it proves you know how to add a WAF. Presumably even one you know how to configure when security needs change. Compliance auditors are mostly there to underwrite posture, not actual risk.
  - SoftTalker 3y ago
    Auditors pretty much only certify that you have told them you are doing what you are supposed to be doing. They are not logging in to your servers and verifying that an AWF is running in front of your web server. They are not probing your network from the outside to see if an AWF is blocking their activity. Just as financial auditors are only confirming that your financial statements match what your accounting department tells them. If you lie to your auditors, there's a good chance they won't catch it because that's not what they are looking for.
    - xyzzy123 3y ago
      It's not a lie! The WAF is there, it's attached and it does absolutely nothing with unmatched performance and scalability. We tell the auditor this. There's no audit checkbox for "WAF actually does something useful", so it's fine.
    - kccqzy 3y ago
      You can lie to these auditors, but you can't lie to pentesters. These people on the other hand are designed to probe your network from the outside.
    - PrimeMcFly 3y ago
      I've audited a lot of networks for compliance, and we always actually check that the protections that are meant to be in place are in place. I don't think I've done an audit where I wasn't using nmap to some degree.
- nullindividual 3y ago
  In my experience with SoX, the auditors are very junior fresh out of college. They check boxes and move on.
- cj 3y ago
  > Certainly says a lot about the auditors... Security auditors are (quite literally) accountants.
Spivak 3y ago
It's gotta be my favorite AWS service for this reason alone. It's almost useless but that's a feature not a bug. They knew exactly their market.
- xer0x 3y ago
  Awesome! I feel so much better about using this to pass an audit.
  - RexM 3y ago
    Same, I was checking usernames to see if I recognized any as former co-workers where we had to do this. I guess there's just a decent market for the product everyone trying to check that box, though.
- ForkMeOnTinder 3y ago
  It pairs well with the checkbox in S3 that you can tick to enable encryption with no other changes to your application.
  - meepmorp 3y ago
    Hey, if someone breaks into an AWS data center and steals some s3 drives, you're totally in the clear.
    - rigelina 3y ago
      You'd think that, but I had an auditor that had guidance requesting confirmation of security cameras on the servers. They wanted to drive to the AWS data center to see the cameras. If the drives got stolen, you'd better make sure AWS shares that video with you.
      - meepmorp 3y ago
        Ok, but what if someone bypasses the cameras on your servers with looped footage? Did the auditor think about having security cameras on the security cameras? Amateurs.

theideaofcoffee 3y ago

As much as I hate to admit it, I've done exactly that and passed the audit. Certainly says a lot about the auditors...

ryanianian 3y ago
It's basically fizzbuzz. If you have a WAF, it proves you know how to add a WAF. Presumably even one you know how to configure when security needs change. Compliance auditors are mostly there to underwrite posture, not actual risk.
- SoftTalker 3y ago
  Auditors pretty much only certify that you have told them you are doing what you are supposed to be doing. They are not logging in to your servers and verifying that an AWF is running in front of your web server. They are not probing your network from the outside to see if an AWF is blocking their activity. Just as financial auditors are only confirming that your financial statements match what your accounting department tells them. If you lie to your auditors, there's a good chance they won't catch it because that's not what they are looking for.
  - xyzzy123 3y ago
    It's not a lie! The WAF is there, it's attached and it does absolutely nothing with unmatched performance and scalability. We tell the auditor this. There's no audit checkbox for "WAF actually does something useful", so it's fine.
  - kccqzy 3y ago
    You can lie to these auditors, but you can't lie to pentesters. These people on the other hand are designed to probe your network from the outside.
  - PrimeMcFly 3y ago
    I've audited a lot of networks for compliance, and we always actually check that the protections that are meant to be in place are in place. I don't think I've done an audit where I wasn't using nmap to some degree.
nullindividual 3y ago
In my experience with SoX, the auditors are very junior fresh out of college. They check boxes and move on.
cj 3y ago
> Certainly says a lot about the auditors... Security auditors are (quite literally) accountants.

Spivak 3y ago

It's gotta be my favorite AWS service for this reason alone. It's almost useless but that's a feature not a bug. They knew exactly their market.

xer0x 3y ago
Awesome! I feel so much better about using this to pass an audit.
- RexM 3y ago
  Same, I was checking usernames to see if I recognized any as former co-workers where we had to do this. I guess there's just a decent market for the product everyone trying to check that box, though.
ForkMeOnTinder 3y ago
It pairs well with the checkbox in S3 that you can tick to enable encryption with no other changes to your application.
- meepmorp 3y ago
  Hey, if someone breaks into an AWS data center and steals some s3 drives, you're totally in the clear.
  - rigelina 3y ago
    You'd think that, but I had an auditor that had guidance requesting confirmation of security cameras on the servers. They wanted to drive to the AWS data center to see the cameras. If the drives got stolen, you'd better make sure AWS shares that video with you.
    - meepmorp 3y ago
      Ok, but what if someone bypasses the cameras on your servers with looped footage? Did the auditor think about having security cameras on the security cameras? Amateurs.