Re:Stop deploying web application firewalls
by patrakov on Tuesday November 14, 2023 @05:45AM
(#38261620)
Here is a big lesson that I "learned": actual security does not matter for the purpose of avoiding risks and fines. What matters is the ability to say "we got hacked despite following the accepted best practice" or "we can shift the blame HERE". Having a paid-for WAF ticks both boxes.
[ Parent
| on HN ]
Re:Stop deploying web application firewalls
by cratermoon on Tuesday November 14, 2023 @11:53AM
(#38265901)
> actual security does not matter
What matters, of course, is money.
Only if the WAFs themselves become a significant attack vector, to the extent where blame for breaches affects the bottom lines of the WAF vendors, the situation will start to change.