Stop deploying web application firewalls

Re:Stop deploying web application firewalls by threeseed on Monday November 13, 2023 @06:22PM (#38256730)

Most enterprises have moved public facing sites to the cloud. And so are making use of the cloud provided WAF solutions all of which are trivial enough for someone to manage part-time.

Also in 20+ years in enterprises have never heard of firewalls being left unmaintained. I don't know how that would pass security audits, why such a critical piece of security architecture would end up in this state or how any in-house development would work given the constant need to make changes to it.

[ Parent | on HN ]

Re:Stop deploying web application firewalls by xyzzy123 on Monday November 13, 2023 @06:56PM (#38257001)

I do agree lightweight cloud WAFs can have positive ROI. You have to be realistic about their capabilities however and what you can expect from a part-timer managing one.

You end up choosing between a heavyweight "advanced" WAF (either cloud or on-prem) that requires lots of tuning and response, which most orgs can't do properly, or a lightweight cloud WAF with vendor rules that doesn't do much but hey at least it's easy to look after.

Re: enterprise WAF maintenance, I know this is anecdotal but I was a pentester for 10 years and I could count the "non-dysfunctional enterprise WAF setups" I saw on one hand. Were you in a role where you talked to the staff who looked after them or dealt with the alerts? Often the org lacked the insight to understand there was a problem. "We bought the magic security box, we applied the patches, what's the issue?"

[ Parent | on HN ]

Re:Stop deploying web application firewalls by scarface_74 on Monday November 13, 2023 @07:27PM (#38257248)

This isn’t true. According to none other than Andy Jassy himself has said that less than 5% of all IT infrastructure is on any cloud provider.

https://accelerationeconomy.com/cloud/amazon-shocker-ceo-jas...

[ Parent | on HN ]

Re:Stop deploying web application firewalls by threeseed on Monday November 13, 2023 @07:49PM (#38257408)

I said "public facing sites" not all IT infrastructure.

And the article you posted is about total spend not just infrastructure.

[ Parent | on HN ]

Re:Stop deploying web application firewalls by scarface_74 on Monday November 13, 2023 @08:12PM (#38257607)

Do you really think that the former CEO of AWS is not referring to the addressable market for cloud?

[ Parent | on HN ]

Re:Stop deploying web application firewalls by callalex on Monday November 13, 2023 @08:22PM (#38257686)

What does that have to do with public facing services? Stop, read, and think before ratcheting up the rudeness.

[ Parent | on HN ]

Re:Stop deploying web application firewalls by scarface_74 on Monday November 13, 2023 @08:30PM (#38257773)

So now you are going to give a better citation than the former CEO of AWS and the current CEO of Amazon…

[ Parent | on HN ]

Re:Stop deploying web application firewalls by PH95VuimJjqBqy on Thursday November 16, 2023 @03:37AM (#38287028)

stop being wrong, it's not rude to point out that you're wrong and with evidence.

[ Parent | on HN ]