I think it's worth mentioning that CloudFlare, while advertising its WAF as a "pro" feature[1], gives it a one-paragraph blurb halfway down its feature page. Do

I think it's worth mentioning that CloudFlare, while advertising its WAF as a "pro" feature[1], gives it a one-paragraph blurb halfway down its feature page. Don't get me wrong--I'm not saying that it's okay to fudge features--but CloudFlare is not primarily marketed as a WAF. Among other security features, CloudFlare is designed to load balance and protect sites from DDoS attacks, which it does well (though, like any service, not perfectly). Additionally, it looks like they assign visitors "reputation scores" that can have different effects based on the status of the application. They also seem to use heuristics to "learn" about new attacks, which while not the fastest way to block attacks can produce some alright results.[2] I'd be interested to see whether the Zero Science Lab study used CloudFlare's feature to allow them to manage mod_security rules or not, and whether that would have made a difference. The PDF does state: > Remember, we are using their Business Plan which should be an enterprise WAF solution for your company. ... but it's unclear which features they enabled. Last point: I've done a lot of web application security assessments, and while, yes, WAFs can help an organization defend against XSS, SQLi, LFI/RFI, CSRF, etc., they are really just bandages over the much more serious issue of insecure code. Developers have a tough job, sure, but there is no WAF that will protect you against all attacks. Maybe ' OR 1=1;-- won't work, but there are a lot of ways--even emerging attack vectors--that security software won't protect against. That said, though, if you're going to rely heavily on a WAF, going with a "sub-feature" like those presented in CloudFlare is definitely not the way to do it. -- As I finished up this comment, I realized that bluetidepro posted some comments from CloudFlare about the report: > @CloudFlare flawed testing strategy that assumes a last-generation, rules-based WAF. We've always worked differently. [3] This statement in particular furthers their own marketing; they're trying to create security via heuristic rules, rather than a static ruleset. Really, a combination would probably be best. -- Lastly: Although this comment might read as a defense of CloudFlare, I'd like to note that I have no affiliation with the organization whatsoever; it just seemed like a very one-sided argument. [1] https://www.cloudflare.com/features-security https://www.cloudflare.com/features-security [2] http://blog.cloudflare.com/thats-freaking-awesome-cloudflare-automatical http://blog.cloudflare.com/thats-freaking-awesome-cloudflare... [3] https://twitter.com/eastdakota/status/307604650436210688 https://twitter.com/eastdakota/status/307604650436210688