3 ms·
WAFs are a key part of a defense in depth model. Also, I don't understand this sentence: "WAF based approach is an admission of ignorance and a position of we
by jedberg 3y ago
WAFs are a key part of a defense in depth model.
Also, I don't understand this sentence: "WAF based approach is an admission of ignorance and a position of weakness, only in this case shifting right into the model is unproven, can't quite be done yet, contrary to ideas like reactive self protection for apps."
- zamadatix 3y agoThe vast majority of WAF deployments seem to be plain defense rather than defense in depth. I.e. WAFs aren't very often deployed because someone wanted an additional layer of protection on top of an already well secured system. Typically they're deployed because nobody can/will add or maintain a sensible level of security to the actual application and reverse proxy itself so the WAF gets thrown in to band-aid that. Additionally, a significant number of enterprise WAFs are deployed just minimally enough to check an auditing/compliance checkbox rather than to solve noted actionable security concerns. As a result, they live up to the quality of implementation they were given.