4 ms·
> they’re generally left them in “audit only mode”, sending logs to a destination accessed by no-one. Aren't these still useful for figuring out what happened
by dataflow 2y ago
> they’re generally left them in “audit only mode”, sending logs to a destination accessed by no-one.
Aren't these still useful for figuring out what happened if you're hacked?
- lmm 2y agoMaybe, if the attacker didn't bother to hack into the WAF itself (generally a softer target than whatever's behind it) and if you bothered keeping or understanding the logs (extremely unlikely to be a good use of resources).
- dataflow 2y agoYou don't need to understand the logs at the time you gather them for this, you just need to keep them long enough to cover the breach, and to be able to understand them after the fact. Hardly seems like an obvious waste to me, and well worth $500/mo.
- lmm 2y ago> you just need to keep them long enough to cover the breach, and to be able to understand them after the fact And avoid leaking customer information/passwords/etc. through them until then, which is the hard part.
- djbusby 2y agoYep. I've seen WAF in "audit mode" and it's got load of client API keys in there, among other fun things. Check the box for WAF but adds a new risk.