Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Discouraging the use of web application firewalls

macchaffee.com

Post reply on HN
Print view View original

121–130 of 145 posts

Re: Discouraging the use of web application firewalls

#121

Post by lmm »

troyvit wrote: post #87

> Now I'll admit these ideas are quite broad Ayup. Especially for small teams working with large piles of software (lookin' at you WordPress) that are insecure out of the box. The ideas are also constrained mainly to fixing SQL injections, which are only an aspect of security. * Isolate components in case of a breach That's great but it doesn't fix a breach, it just limits the scope. Better than nothing but if a WAF…

> Do any of these help against a DDOS, or even accidental DOS caused by search spam? Nah, but a WAF at the edge stops the latter in its tracks.

Only if the WAF can reject bad requests more cheaply than the thing behind it. IME if your app is implemented decently it will outperform the WAF.

Re: Discouraging the use of web application firewalls

#122

Post by jauntywundrkind »

There's so much excusing away while things will be bad, for a long time, but that doesn't seem particularly hacker-ful. I'm glad those views are represented, but as many HN threads the status quo is again decidedly notably business-as-usual in-defense-of-meh.

That said, I do think front end routers are just taking over. Kubernetes Gateway API is the front end API, hard fought for & iterated again and again and again, to become a baseline set of expectations that's basically great. Having a front end that can compose routes is so so so good & powerful, needed to be standardized, and this seems far & away like what is happening.

I tend to agree that we have too often in the past intermediated our services. It wasn't even a firewall, but my org used to basically out of habit put an nginx in each container in front of node. No one knew why, no one could conjecture what for, but we just let it roll. WAF is that kind of thoughtless mindless zombie nonsense.

Re: Discouraging the use of web application firewalls

#123

Post by mox1 »

xyzzy123 wrote: post #64
threeseed wrote: post #35

Earlier quoted context omitted.

1) WAF do far more than just prevent SQL injections. 2) Many companies don't own the software they run and so they can't guarantee that it is free of SQL injections or that the version of ORM libraries are secure. WAF protect against this. 3) Auto-scaling is just as much about high availability than performance. Database indexes do not help with the former.

Look, if you want a "real" WAF capability you buy something like Imperva and manage the care and feeding of a team of say 2-4 ppl who understand web app vulnerabilities in depth, AND know the tool. Your SOC/NOC will need training and procedures too. Fully loaded an average enterprise will pay > $1M a year to maintain the capability if you look at the TCO carefully. There are environments where this makes sense. Banks…

Can confirm. I work in financial services, we employ Imperva for WAF + DDoS.

Initial onboard was 2 FTE for ~6 months.

We are now at probably .5-.75 FTE. Onboarding new sites, responding to “waf broke the site”, type things and doing exceptions (for pen tests and what not).

Not sure of the TCO, but I shudder to think what would happen if we didnt have it.

We have a lot of…old…java…

Re: Discouraging the use of web application firewalls

#124

Post by scarface_74 »

threeseed wrote: post #115
scarface_74 wrote: post #111

Earlier quoted context omitted.

This isn’t true. According to none other than Andy Jassy himself has said that less than 5% of all IT infrastructure is on any cloud provider. https://accelerationeconomy.com/cloud/amazon-shocker-ceo-jas...

I said "public facing sites" not all IT infrastructure. And the article you posted is about total spend not just infrastructure.

Do you really think that the former CEO of AWS is not referring to the addressable market for cloud?

Re: Discouraging the use of web application firewalls

#125

Post by callalex »

scarface_74 wrote: post #124
threeseed wrote: post #115

Earlier quoted context omitted.

I said "public facing sites" not all IT infrastructure. And the article you posted is about total spend not just infrastructure.

Do you really think that the former CEO of AWS is not referring to the addressable market for cloud?

What does that have to do with public facing services? Stop, read, and think before ratcheting up the rudeness.

Re: Discouraging the use of web application firewalls

#126

Post by montroser »

meepmorp wrote: post #110
rigelina wrote: post #76

Earlier quoted context omitted.

You'd think that, but I had an auditor that had guidance requesting confirmation of security cameras on the servers. They wanted to drive to the AWS data center to see the cameras. If the drives got stolen, you'd better make sure AWS shares that video with you.

Ok, but what if someone bypasses the cameras on your servers with looped footage? Did the auditor think about having security cameras on the security cameras? Amateurs.

Have they never seen Speed?

Re: Discouraging the use of web application firewalls

#127

Post by scarface_74 »

callalex wrote: post #125
scarface_74 wrote: post #124

Earlier quoted context omitted.

Do you really think that the former CEO of AWS is not referring to the addressable market for cloud?

What does that have to do with public facing services? Stop, read, and think before ratcheting up the rudeness.

So now you are going to give a better citation than the former CEO of AWS and the current CEO of Amazon…

Re: Discouraging the use of web application firewalls

#128

Post by thedougd »

I never saw much discussion as to why Capital One’s IAM role for their WAF gave broad access to a number of S3 buckets. That SSRF attack should have resulted in the exposure of the WAF logs, at worst.

Who wrote the policy? Was it a centralized IAM team? Does a centralized IAM team make for more granular or more one size fits all IAM policies?

Re: Discouraging the use of web application firewalls

#130

Post by jwestbury »

kibwen wrote: post #18
briffle wrote: post #3

Earlier quoted context omitted.

We are still waiting on compliance standards to update their password change policies to reflect what most people have been saying for over a decade, that frequently changing passwords are a security risk..

NIST itself has been actively discouraging password rotation since 2016: https://pages.nist.gov/800-63-3/sp800-63b.html#memorizedsecr...

NIST discourages it, but most of the US government still requires it. In fact, I used to have a 60-day password rotation policy with such brilliant requirements as "no more than three characters of one class sequentially."

I soon realised that "ShitFuck!", thus, was a valid password -- and off I went. Meanwhile, a teammate who had previously been a technical writer contracting with the NSA told of the "waterfall method" -- not of software developments, but of passwords. It was common in his world, apparently, and you could always hear he was typing his password by the staccato of QazWsxEdc123, etc.

Post reply on HN