101–110 of 145 posts
How do you handle requests with obvious malicious intend like „/wp-admin/„ on a Java service? Do you ignore these kind of mass/spam requests? Do you block those requests? I‘m curious.
Earlier quoted context omitted.
Look, if you want a "real" WAF capability you buy something like Imperva and manage the care and feeding of a team of say 2-4 ppl who understand web app vulnerabilities in depth, AND know the tool. Your SOC/NOC will need training and procedures too. Fully loaded an average enterprise will pay > $1M a year to maintain the capability if you look at the TCO carefully. There are environments where this makes sense. Banks…
Most enterprises have moved public facing sites to the cloud. And so are making use of the cloud provided WAF solutions all of which are trivial enough for someone to manage part-time. Also in 20+ years in enterprises have never heard of firewalls being left unmaintained. I don't know how that would pass security audits, why such a critical piece of security architecture would end up in this state or how any in-house…
You end up choosing between a heavyweight "advanced" WAF (either cloud or on-prem) that requires lots of tuning and response, which most orgs can't do properly, or a lightweight cloud WAF with vendor rules that doesn't do much but hey at least it's easy to look after.
Re: enterprise WAF maintenance, I know this is anecdotal but I was a pentester for 10 years and I could count the "non-dysfunctional enterprise WAF setups" I saw on one hand. Were you in a role where you talked to the staff who looked after them or dealt with the alerts? Often the org lacked the insight to understand there was a problem. "We bought the magic security box, we applied the patches, what's the issue?"
Earlier quoted context omitted.
I did not downvote you, but as the article explains, WAFs don't protect against anything assuming the attacker bothers to spend five minutes bypassing them with one of a thousand well-known tricks.
> assuming the attacker bothers to spend five minutes bypassing them with one of a thousand well-known tricks I didn't realise AWS, Cloudflare etc were so incompetent that their product can be bypassed in 5 minutes. I assume you have an example of this.
Most large companies have too many developers and too many teams to expect/assume that each team will do the right thing for security when putting something in production on the public Internet. Why? Because most software developers are bad at security (I said most not all). So yes do all the things at the bottom of this article! Teach security-by-design to all your teams. Make sure they know what OWASP is at least.…
> Why? Because most software developers are bad at security (I said most not all). In my experience it is that most software engineers are not incentivized to care about security.
Earlier quoted context omitted.
It's basically fizzbuzz. If you have a WAF, it proves you know how to add a WAF. Presumably even one you know how to configure when security needs change. Compliance auditors are mostly there to underwrite posture, not actual risk.
Auditors pretty much only certify that you have told them you are doing what you are supposed to be doing. They are not logging in to your servers and verifying that an AWF is running in front of your web server. They are not probing your network from the outside to see if an AWF is blocking their activity. Just as financial auditors are only confirming that your financial statements match what your accounting depart…
People will stop deploying WAFs when the compliance standards are rewritten to not require them. They are prominent in lots of installations because the box ticking exercise of compliance frameworks, namely PCI or HIPAA, require a WAF-like component to reach compliance. It took long enough for them to be written in that now everyone knows they need one. It will be even longer for them to be phased out, and no one wit…
This sounds so much like music to my ears. Where I work a WAF is mandatory, Azure Application Gateway in our instance, and they enable ALL of the rules because the outsourced colleagues they follow the rules set by infosec like sheep. The consequences are that many requests are blocked as a false positive. Completely legitimate requests, like for instance an OpenID redirect from Azure AD (Microsoft Online) login to t…
> Azure Application Gateway Such a shame that you're forced to use this. We run Azure Function apps directly to public traffic and the experience is really nice & simple. Not once have I had a "I wonder if a middleman ate my request" experience. OIDC works flawlessly for us. I would quickly grow to hate my tech stack if I had to cram stuff like AAG into it. Right now, we can spin up a very robust stack with ~3 produc…
Well said. I’d agree that for most scenarios, one never has to touch these. That’s one of the actual selling points of cloud.
Earlier quoted context omitted.
We are still waiting on compliance standards to update their password change policies to reflect what most people have been saying for over a decade, that frequently changing passwords are a security risk..
NIST itself has been actively discouraging password rotation since 2016: https://pages.nist.gov/800-63-3/sp800-63b.html#memorizedsecr...
Earlier quoted context omitted.
Hey, if someone breaks into an AWS data center and steals some s3 drives, you're totally in the clear.
You'd think that, but I had an auditor that had guidance requesting confirmation of security cameras on the servers. They wanted to drive to the AWS data center to see the cameras. If the drives got stolen, you'd better make sure AWS shares that video with you.
Amateurs.