4 ms·

Eh, I wouldn't say they fell out of favor in "the enterprise". There are an awful lot of Fortune 500-type shops with WAFs via Akamai or Cloudflare.

zaphar 3y ago
They definitely haven't. But that's mostly not due to how effective they are. It's more due to the fact that some regulatory or industry standard the enterprise promises to follow requires a WAF to be in place. If not by directly requiring then by heavily implying it in such a way that it's just easier to put one in place so the auditor won't ask questions.
- marcus0x62 3y ago
  Sure, but I think you can make the same comment about the motivation behind and effectiveness of almost any security measure in the enterprise space. WAFs aren’t particularly bad or particularly ineffective… They just aren’t good.
  - mindcrime 3y ago
    Sure, but I think you can make the same comment about the motivation behind and effectiveness of almost any security measure in the enterprise space. Hence the notion of layering and "defense in depth". But as old as this idea is, it seems like some people are still looking for / expecting silver bullets that magically "fix security". Also consider threat modeling... what security measure one needs to take are driven at least in part by factors like "how valuable is what you're protecting?" and "what are the expected capabilities of the enemy who would be attacking you?" and so on.
- acdha 3y ago
  It’s not that simple. You’re right that many places have compliance policies but that’s not all, or even most, of the benefit. WAFs are useful any time you don’t have a team of experienced 24x7 engineers who have complete control and knowledge of each and every application on your network, which isn’t the case for any large organization. When things like log4j come out, it’s really nice to be able to have a vendor like Cloudflare or AWS deploy a single rule off-hours which will cover all of your public facing services, especially when some of them are not your own code or hard to deploy. It’s one thing if a patch is a single line change pushed out in your CD pipeline than if it’s “beg the vendor for an update, get an emergency CAB approved, and follow the 97 step Word document”.
  - Tijdreiziger 3y ago
    > which isn’t the case for any large organization. …and it isn’t the case for most small organizations either.
    - acdha 3y ago
      I agree but it’s more possible this far into the cloud era that, say, a small business might have outsourced everything but their own application.
- jerf 3y ago
  WAFs are a manifestation of Conway's Law: The people responsible for securing the company's web presence are not in general the same as the people implementing the web request. When some API has some security issue, the securing team needs some mechanism to handle the issue faster than the API can be fixed. With that specification, you pretty much end up with a WAF, once you've been around the design space a few dozen times to refine the final product. If you are not a large corporation it may seem silly, but as the corporations scale up they become simply a necessity. If you like, call it "non-technical reasons", but it doesn't change their necessity. WAFs do things like securing an API written years ago by people no longer at the company, that for legal reasons can not be "just" modified or taken down, but which also can't be left with an arbitrary code execution vulnerability in it. By all means when possible fix the real underlying vulnerabilities, but at scale that gets to be easier said than done. In real life you may be arguing for weeks about whose "fault" it is, whose responsibility it is, whether it is even a bug or a real issue, and in the meantime, the company wants some ability to deal with this.
  - beardedwizard 3y ago
    I totally agree - for companies with opportunities to embed security more deeply, waf is rarely the right choice
- PH95VuimJjqBqy 3y ago
  > It's more due to the fact that some regulatory or industry standard the enterprise promises to follow requires a WAF to be in place. This is the comment I was looking for. This is exactly right, most companies do it to check a box for compliance.
deleted 3y ago
[deleted]

zaphar 3y ago

They definitely haven't. But that's mostly not due to how effective they are. It's more due to the fact that some regulatory or industry standard the enterprise promises to follow requires a WAF to be in place. If not by directly requiring then by heavily implying it in such a way that it's just easier to put one in place so the auditor won't ask questions.

marcus0x62 3y ago
Sure, but I think you can make the same comment about the motivation behind and effectiveness of almost any security measure in the enterprise space. WAFs aren’t particularly bad or particularly ineffective… They just aren’t good.
- mindcrime 3y ago
  Sure, but I think you can make the same comment about the motivation behind and effectiveness of almost any security measure in the enterprise space. Hence the notion of layering and "defense in depth". But as old as this idea is, it seems like some people are still looking for / expecting silver bullets that magically "fix security". Also consider threat modeling... what security measure one needs to take are driven at least in part by factors like "how valuable is what you're protecting?" and "what are the expected capabilities of the enemy who would be attacking you?" and so on.
acdha 3y ago
It’s not that simple. You’re right that many places have compliance policies but that’s not all, or even most, of the benefit. WAFs are useful any time you don’t have a team of experienced 24x7 engineers who have complete control and knowledge of each and every application on your network, which isn’t the case for any large organization. When things like log4j come out, it’s really nice to be able to have a vendor like Cloudflare or AWS deploy a single rule off-hours which will cover all of your public facing services, especially when some of them are not your own code or hard to deploy. It’s one thing if a patch is a single line change pushed out in your CD pipeline than if it’s “beg the vendor for an update, get an emergency CAB approved, and follow the 97 step Word document”.
- Tijdreiziger 3y ago
  > which isn’t the case for any large organization. …and it isn’t the case for most small organizations either.
  - acdha 3y ago
    I agree but it’s more possible this far into the cloud era that, say, a small business might have outsourced everything but their own application.
jerf 3y ago
WAFs are a manifestation of Conway's Law: The people responsible for securing the company's web presence are not in general the same as the people implementing the web request. When some API has some security issue, the securing team needs some mechanism to handle the issue faster than the API can be fixed. With that specification, you pretty much end up with a WAF, once you've been around the design space a few dozen times to refine the final product. If you are not a large corporation it may seem silly, but as the corporations scale up they become simply a necessity. If you like, call it "non-technical reasons", but it doesn't change their necessity. WAFs do things like securing an API written years ago by people no longer at the company, that for legal reasons can not be "just" modified or taken down, but which also can't be left with an arbitrary code execution vulnerability in it. By all means when possible fix the real underlying vulnerabilities, but at scale that gets to be easier said than done. In real life you may be arguing for weeks about whose "fault" it is, whose responsibility it is, whether it is even a bug or a real issue, and in the meantime, the company wants some ability to deal with this.
- beardedwizard 3y ago
  I totally agree - for companies with opportunities to embed security more deeply, waf is rarely the right choice
PH95VuimJjqBqy 3y ago
> It's more due to the fact that some regulatory or industry standard the enterprise promises to follow requires a WAF to be in place. This is the comment I was looking for. This is exactly right, most companies do it to check a box for compliance.

deleted 3y ago

[deleted]