4 ms·
In my experience WAFs are not something that one should ever "just turn on". Complete due diligence is required to fully understand and realise the impact of t
by everfrustrated 3y ago
In my experience WAFs are not something that one should ever "just turn on".
Complete due diligence is required to fully understand and realise the impact of the rules and should be tested like any software change by going through a testing phase.
Ideally software teams should be fully trained and be responsible for their lifecycle.
- macNchz 3y agoYes you need to be familiar with the rulesets being applied, and prepared to closely monitor what is being blocked. Ideally I think I’d roll it out one ruleset at a time to limit the number of potential issues being introduced at once. Had a fun one after turning on the AWS WAF with some default rules–a small number of users reported they couldn’t upload new logo images anymore. Turned out some Adobe product was adding XML metadata to the image files, which the WAF picked up and blocked.
- marcosdumay 3y agoJust to add, but only testing will never work well enough for something like this. This is one of the cases where you must understand what you are doing. There's no technique for doing it mindlessnessly.
- arter4 3y agoAgree. There are so many ways WAF rules can unintentionally block legitimate traffic. From very long URLs (is that a DoS attempt?), to special characters in a POST with a file upload (is that = part of a SQL injection attempt or is that just part of a base64 encoded file?) and so on.