Re:Stop deploying web application firewalls
by cratermoon on Monday November 13, 2023 @07:14PM
(#38257152)
The article notes the problem of the attack surface of WAF products themselves, and raises questions about the security posture of the products and the vendors. Compliance standards need to address the risks and weigh them against the benefits of WAFs. If, as the author argues, they have reached a point where they do more harm than good, the compliance bodies need to be honest about that and reevaluate recommendations.
[ Parent
| on HN ]
Re:Stop deploying web application firewalls
by patrakov on Tuesday November 14, 2023 @05:45AM
(#38261620)
Here is a big lesson that I "learned": actual security does not matter for the purpose of avoiding risks and fines. What matters is the ability to say "we got hacked despite following the accepted best practice" or "we can shift the blame HERE". Having a paid-for WAF ticks both boxes.
Re:Stop deploying web application firewalls
by cratermoon on Tuesday November 14, 2023 @11:53AM
(#38265901)
> actual security does not matter
What matters, of course, is money.
Only if the WAFs themselves become a significant attack vector, to the extent where blame for breaches affects the bottom lines of the WAF vendors, the situation will start to change.