Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Discouraging the use of web application firewalls

macchaffee.com

Post reply on HN
Print view View original

111–120 of 145 posts

Re: Discouraging the use of web application firewalls

#111

Post by scarface_74 »

threeseed wrote: post #88
xyzzy123 wrote: post #64

Earlier quoted context omitted.

Look, if you want a "real" WAF capability you buy something like Imperva and manage the care and feeding of a team of say 2-4 ppl who understand web app vulnerabilities in depth, AND know the tool. Your SOC/NOC will need training and procedures too. Fully loaded an average enterprise will pay > $1M a year to maintain the capability if you look at the TCO carefully. There are environments where this makes sense. Banks…

Most enterprises have moved public facing sites to the cloud. And so are making use of the cloud provided WAF solutions all of which are trivial enough for someone to manage part-time. Also in 20+ years in enterprises have never heard of firewalls being left unmaintained. I don't know how that would pass security audits, why such a critical piece of security architecture would end up in this state or how any in-house…

This isn’t true. According to none other than Andy Jassy himself has said that less than 5% of all IT infrastructure is on any cloud provider.

https://accelerationeconomy.com/cloud/amazon-shocker-ceo-jas...

Re: Discouraging the use of web application firewalls

#112

Post by verve_rat »

sbarre wrote: post #100
verve_rat wrote: post #62

Earlier quoted context omitted.

> Why? Because most software developers are bad at security (I said most not all). In my experience it is that most software engineers are not incentivized to care about security.

This is my personal opinion but any developer building software that runs on the public Internet should not need to be incentivized to care about security. It's a fundamental part of the job.

Let me rephrase: software development (the action of engineers and the whole process in general) is actively insensitvised to not care about security.

The consequences of poor security are often way, way lower than the costs of doing it properly. Add on to that, that security problems are contingent risks that only "pay out" in a small number of cases and you have a recipe for low expected value for investment into security.

Software engineers often want to develop a secure product, but they don't know what they don't know, and their employer is not interested in investment in their security capabilities, both the companies security capabilities and the capabilities of their employees.

Re: Discouraging the use of web application firewalls

#113

Post by phendrenad2 »

salzig wrote: post #98

How do you handle requests with obvious malicious intend like „/wp-admin/„ on a Java service? Do you ignore these kind of mass/spam requests? Do you block those requests? I‘m curious.

Your application should be able to handle requests nearly as fast as a WAF. If your app is very slow to serve a 404 page, you'll want to fix that.

Re: Discouraging the use of web application firewalls

#114

Post by threeseed »

diarrhea wrote: post #90
threeseed wrote: post #85

Earlier quoted context omitted.

I read it and it's a design decision documented here: https://docs.aws.amazon.com/waf/latest/developerguide/waf-ov... For oversize requests WAF can be configured to reject it.

Two observations: 8KB is a small amount of data. Many apps will need more, so will not be able to blanket block these. Even 64k, what appears to be the absolute limit, might not be enough. Continuing, not blocking, is the default when not using the console, making this insecure by default.

You should be using multi-part/chunked encoding for large file sizes as it helps prevents DDOS attacks.

And having an insecure default is a huge difference from 100% of requests are allowed.

Re: Discouraging the use of web application firewalls

#115

Post by threeseed »

scarface_74 wrote: post #111
threeseed wrote: post #88

Earlier quoted context omitted.

Most enterprises have moved public facing sites to the cloud. And so are making use of the cloud provided WAF solutions all of which are trivial enough for someone to manage part-time. Also in 20+ years in enterprises have never heard of firewalls being left unmaintained. I don't know how that would pass security audits, why such a critical piece of security architecture would end up in this state or how any in-house…

This isn’t true. According to none other than Andy Jassy himself has said that less than 5% of all IT infrastructure is on any cloud provider. https://accelerationeconomy.com/cloud/amazon-shocker-ceo-jas...

I said "public facing sites" not all IT infrastructure.

And the article you posted is about total spend not just infrastructure.

Re: Discouraging the use of web application firewalls

#116

Post by lousken »

I don't see issues with WAF. Sure, it takes some time to set up so that you have I do however have issues stupid CAPTCHAs like Cloudflare has that even humans can't pass through when using a privacy oriented browser. Sites should serve visitors and not the other way around.

Re: Discouraging the use of web application firewalls

#117

Post by salzig »

phendrenad2 wrote: post #113
salzig wrote: post #98

How do you handle requests with obvious malicious intend like „/wp-admin/„ on a Java service? Do you ignore these kind of mass/spam requests? Do you block those requests? I‘m curious.

Your application should be able to handle requests nearly as fast as a WAF. If your app is very slow to serve a 404 page, you'll want to fix that.

I count this as „I ignore them“

Re: Discouraging the use of web application firewalls

#118

Post by salzig »

technion wrote: post #101
salzig wrote: post #98

How do you handle requests with obvious malicious intend like „/wp-admin/„ on a Java service? Do you ignore these kind of mass/spam requests? Do you block those requests? I‘m curious.

The usual answer is your WAF blocks them and then you write a report counting it in the cyber attacks blocked by the WAF, proving it saved the company.

That sounds like hell, not sure if should count this as „blocked“ or more as a „I ignore them, but I need follow enterprise BS policy so they end up blocked“

Re: Discouraging the use of web application firewalls

#119

Post by lmm »

threeseed wrote: post #35
jiggawatts wrote: post #9

Earlier quoted context omitted.

I call it magic security pixie dust. You sprinkle it on top of code riddled with SQL injections nobody could be bothered to avoid or fix, and now magically the code has a become secure! You’ll find it on the shelf next to auto-scaling cloud wizardry, which can similarly be used to fix the total absence of indexes in the database.

1) WAF do far more than just prevent SQL injections. 2) Many companies don't own the software they run and so they can't guarantee that it is free of SQL injections or that the version of ORM libraries are secure. WAF protect against this. 3) Auto-scaling is just as much about high availability than performance. Database indexes do not help with the former.

> 1) WAF do far more than just prevent SQL injections.

They largely don't prevent SQL injections.

> 2) Many companies don't own the software they run and so they can't guarantee that it is free of SQL injections or that the version of ORM libraries are secure. WAF protect against this.

Only if the WAF somehow understands the internals of that software better than that software itself. Which, sure, sometimes happens, but there's no systematic reason to believe it. Why should the WAF have a better hit rate than the makers of the actual application? Does the WAF vendor offer a guarantee that systems behind it wil never be hacked?

Re: Discouraging the use of web application firewalls

#120

Post by lmm »

allanrbo wrote: post #65

I think of WAFs as an extra safety net. Defense in depth. The author complained about the performance cost of WAFs in general, but not all WAFs have be structured like ModSecurity. They could for example be based on something like https://github.com/intel/hyperscan and perf is at a very different level.

> I think of WAFs as an extra safety net. Defense in depth.

The WAF itself is a complex codebase written in a performance-critical domain, so they're generally implemented in memory-unsafe languages. If the services behind the WAF are implemented at all competently, you're probably increasing the attack surface by more by adding the WAF than you're saving.

Post reply on HN