Belongs on the security snakeoil shelf right next to sudo and fail2ban.
Discouraging the use of web application firewalls
81–90 of 145 posts
Re: Discouraging the use of web application firewalls
#82Earlier quoted context omitted.
We are still waiting on compliance standards to update their password change policies to reflect what most people have been saying for over a decade, that frequently changing passwords are a security risk..
The PCI-DSS website itself requires that you change password every 12 months. At the same time the period for recertifying PCI-DSS is ... every 12 months. I have a systematic way to create a new password each time, which probably isn't secure.
I have to rotate my password at work every 3 months. Without a system, it wouldn’t be sustainable.
Re: Discouraging the use of web application firewalls
#83So a WAF is something you deploy to man-in-the-middle your own traffic, but it is ok because "you kind of know the guy in the middle"? Please inspect all my HTTPS traffic, I terminated SSL, so you are free to modify the HTTP, no one will know, we trust you completely! Why is this a good idea exactly?
Application load balancers do the same thing.
I mean, you know TLS will have to be terminated at some point anyways. Might as well rage against NGINX terminating the TLS instead of whatever back end you're using (Node, Django, whatever).
Re: Discouraging the use of web application firewalls
#84The argument in this post seems to be not against WAFs, but against poorly written and slow WAFs.
Re: Discouraging the use of web application firewalls
#85Earlier quoted context omitted.
> assuming the attacker bothers to spend five minutes bypassing them with one of a thousand well-known tricks I didn't realise AWS, Cloudflare etc were so incompetent that their product can be bypassed in 5 minutes. I assume you have an example of this.
Padding requests with 8k of normal looking data will bypass AWS's WAF 100% of the time according to the article. Maybe you should read it.
I read it and it's a design decision documented here:
https://docs.aws.amazon.com/waf/latest/developerguide/waf-ov...
For oversize requests WAF can be configured to reject it.
Re: Discouraging the use of web application firewalls
#86Earlier quoted context omitted.
I call it magic security pixie dust. You sprinkle it on top of code riddled with SQL injections nobody could be bothered to avoid or fix, and now magically the code has a become secure! You’ll find it on the shelf next to auto-scaling cloud wizardry, which can similarly be used to fix the total absence of indexes in the database.
> magically the code has a become secure! The code hasn't, but it would be a lie to say that the application hasn't, and as a leader of ops teams while I can't directly influence code security & quality, I can damn sure influence overall security by demanding a WAF. Defense in depth is an important concept in security for a very good reason.
> The code hasn't, but it would be a lie to say that the application hasn't
It could become less secure too, as WAF software itself can have vulnerabilities or misconfiguration.
Re: Discouraging the use of web application firewalls
#87> Now I'll admit these ideas are quite broad
Ayup. Especially for small teams working with large piles of software (lookin' at you WordPress) that are insecure out of the box. The ideas are also constrained mainly to fixing SQL injections, which are only an aspect of security.
* Isolate components in case of a breach That's great but it doesn't fix a breach, it just limits the scope. Better than nothing but if a WAF stops the breach from happening ...?
* Immutability Cool for those teams that have control of their entire infrastructure. However this also only solves those cases that are caused by mutability.
* Static analysis to look for stuff like devs forgetting to use prepared statements. Definitely! Sure! But again, if you're using a piece of software off the shelf a lot of that is out of your hands.
* Restricting API endpoints to limit access to necessary tables Another great idea if you are in control of your software. Hacking into a fairly large project like WordPress to effect these changes (if they aren't already) would require a large team and a ton of maintenance. Basically it'd be a fork.
Do any of these help against a DDOS, or even accidental DOS caused by search spam? Nah, but a WAF at the edge stops the latter in its tracks. I'm not saying a WAF is a panacea for all ills, and yeah I bet a rethink would mean better-built web app firewalls, but discouraging their use would cripple most of the long-tail of the web and honestly that's where all the cool stuff is anyway.
Re: Discouraging the use of web application firewalls
#88Earlier quoted context omitted.
1) WAF do far more than just prevent SQL injections. 2) Many companies don't own the software they run and so they can't guarantee that it is free of SQL injections or that the version of ORM libraries are secure. WAF protect against this. 3) Auto-scaling is just as much about high availability than performance. Database indexes do not help with the former.
Look, if you want a "real" WAF capability you buy something like Imperva and manage the care and feeding of a team of say 2-4 ppl who understand web app vulnerabilities in depth, AND know the tool. Your SOC/NOC will need training and procedures too. Fully loaded an average enterprise will pay > $1M a year to maintain the capability if you look at the TCO carefully. There are environments where this makes sense. Banks…
Most enterprises have moved public facing sites to the cloud. And so are making use of the cloud provided WAF solutions all of which are trivial enough for someone to manage part-time.
Also in 20+ years in enterprises have never heard of firewalls being left unmaintained. I don't know how that would pass security audits, why such a critical piece of security architecture would end up in this state or how any in-house development would work given the constant need to make changes to it.
Re: Discouraging the use of web application firewalls
#89I don't see the world as black-and-white as the author does.
The thing is, as soon as you're reachable from the Internet, you will get bombarded by crap. Skiddies just blasting every IP they can with Wordpress exploits, log4j exploits, whatever. People DDoSing you for the lulz or for ransom. A WAF and CDN - personally I like what AWS has to offer - is basically a tool that's (unfortunately) required to be on the Internet these days.
Re: Discouraging the use of web application firewalls
#90Earlier quoted context omitted.
Padding requests with 8k of normal looking data will bypass AWS's WAF 100% of the time according to the article. Maybe you should read it.
I read it and it's a design decision documented here: https://docs.aws.amazon.com/waf/latest/developerguide/waf-ov... For oversize requests WAF can be configured to reject it.
Two observations:
8KB is a small amount of data. Many apps will need more, so will not be able to blanket block these. Even 64k, what appears to be the absolute limit, might not be enough.
Continuing, not blocking, is the default when not using the console, making this insecure by default.