Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Discouraging the use of web application firewalls

macchaffee.com

Post reply on HN
Print view View original

41–50 of 145 posts

Re: Discouraging the use of web application firewalls

#41

Post by SoftTalker »

ryanianian wrote: post #19
theideaofcoffee wrote: post #15

Earlier quoted context omitted.

As much as I hate to admit it, I've done exactly that and passed the audit. Certainly says a lot about the auditors...

It's basically fizzbuzz. If you have a WAF, it proves you know how to add a WAF. Presumably even one you know how to configure when security needs change. Compliance auditors are mostly there to underwrite posture, not actual risk.

Auditors pretty much only certify that you have told them you are doing what you are supposed to be doing. They are not logging in to your servers and verifying that an AWF is running in front of your web server. They are not probing your network from the outside to see if an AWF is blocking their activity.

Just as financial auditors are only confirming that your financial statements match what your accounting department tells them.

If you lie to your auditors, there's a good chance they won't catch it because that's not what they are looking for.

Re: Discouraging the use of web application firewalls

#42

Post by RexM »

xer0x wrote: post #30
Spivak wrote: post #26

Earlier quoted context omitted.

It's gotta be my favorite AWS service for this reason alone. It's almost useless but that's a feature not a bug. They knew exactly their market.

Awesome! I feel so much better about using this to pass an audit.

Same, I was checking usernames to see if I recognized any as former co-workers where we had to do this.

I guess there's just a decent market for the product everyone trying to check that box, though.

Re: Discouraging the use of web application firewalls

#43

Post by ppierald »

A few points.

PCI-DSS does not mandate the use of a WAF. It is one of two ways you can fulfill requirement 6.5 or 6.6. WAF + OWASP Top Ten ruleset is typically easier to get evidence for your auditor, but you can show that continuous scanning using a DAST scanning engine to meet requirements.

I would have a WAF installed with very few highly tuned rules against mostly SQLi. Why? Because the damage of letting that through and praying that the developer or web-app framework does it right are significant. The rules for SQLi are pretty easy to get right and dropping that traffic before it gets to your web server is a reasonable thing.

I would have a WAF installed with no rules too. It is nice to have something there where you can drop in a Log4J rule and get protection relatively quickly for attacks of that nature. There have been a number of these over the years and a small performance penalty seems worth the big picture safety net.

I am against the pricey models that the cloud vendors push. WAF can get expensive. They typically are bundled with other cloud services, but hey, if you've gotten that far, you are probably outsourcing most things to the cloud provider anyway.

I do not like WAF pragmatically because it lets the developer off the hook in many ways. There is something there doing their work for them and another reason for some developers to not understand or care about the security of their applications. Something else will do it for me whether I know this or not.

Re: Discouraging the use of web application firewalls

#44

Post by hug »

jiggawatts wrote: post #9
theideaofcoffee wrote: post #2

People will stop deploying WAFs when the compliance standards are rewritten to not require them. They are prominent in lots of installations because the box ticking exercise of compliance frameworks, namely PCI or HIPAA, require a WAF-like component to reach compliance. It took long enough for them to be written in that now everyone knows they need one. It will be even longer for them to be phased out, and no one wit…

I call it magic security pixie dust. You sprinkle it on top of code riddled with SQL injections nobody could be bothered to avoid or fix, and now magically the code has a become secure! You’ll find it on the shelf next to auto-scaling cloud wizardry, which can similarly be used to fix the total absence of indexes in the database.

> magically the code has a become secure!

The code hasn't, but it would be a lie to say that the application hasn't, and as a leader of ops teams while I can't directly influence code security & quality, I can damn sure influence overall security by demanding a WAF.

Defense in depth is an important concept in security for a very good reason.

Re: Discouraging the use of web application firewalls

#45

Post by hermannj314 »

So a WAF is something you deploy to man-in-the-middle your own traffic, but it is ok because "you kind of know the guy in the middle"?

Please inspect all my HTTPS traffic, I terminated SSL, so you are free to modify the HTTP, no one will know, we trust you completely!

Why is this a good idea exactly?

Re: Discouraging the use of web application firewalls

#46

Post by rwmj »

briffle wrote: post #3
theideaofcoffee wrote: post #2

People will stop deploying WAFs when the compliance standards are rewritten to not require them. They are prominent in lots of installations because the box ticking exercise of compliance frameworks, namely PCI or HIPAA, require a WAF-like component to reach compliance. It took long enough for them to be written in that now everyone knows they need one. It will be even longer for them to be phased out, and no one wit…

We are still waiting on compliance standards to update their password change policies to reflect what most people have been saying for over a decade, that frequently changing passwords are a security risk..

The PCI-DSS website itself requires that you change password every 12 months. At the same time the period for recertifying PCI-DSS is ... every 12 months. I have a systematic way to create a new password each time, which probably isn't secure.

Re: Discouraging the use of web application firewalls

#47

Post by xyzzy123 »

SoftTalker wrote: post #41
ryanianian wrote: post #19

Earlier quoted context omitted.

It's basically fizzbuzz. If you have a WAF, it proves you know how to add a WAF. Presumably even one you know how to configure when security needs change. Compliance auditors are mostly there to underwrite posture, not actual risk.

Auditors pretty much only certify that you have told them you are doing what you are supposed to be doing. They are not logging in to your servers and verifying that an AWF is running in front of your web server. They are not probing your network from the outside to see if an AWF is blocking their activity. Just as financial auditors are only confirming that your financial statements match what your accounting depart…

It's not a lie! The WAF is there, it's attached and it does absolutely nothing with unmatched performance and scalability. We tell the auditor this.

There's no audit checkbox for "WAF actually does something useful", so it's fine.

Re: Discouraging the use of web application firewalls

#48

Post by SonOfLilit »

threeseed wrote: post #35
jiggawatts wrote: post #9

Earlier quoted context omitted.

I call it magic security pixie dust. You sprinkle it on top of code riddled with SQL injections nobody could be bothered to avoid or fix, and now magically the code has a become secure! You’ll find it on the shelf next to auto-scaling cloud wizardry, which can similarly be used to fix the total absence of indexes in the database.

1) WAF do far more than just prevent SQL injections. 2) Many companies don't own the software they run and so they can't guarantee that it is free of SQL injections or that the version of ORM libraries are secure. WAF protect against this. 3) Auto-scaling is just as much about high availability than performance. Database indexes do not help with the former.

I did not downvote you, but as the article explains, WAFs don't protect against anything assuming the attacker bothers to spend five minutes bypassing them with one of a thousand well-known tricks.

Re: Discouraging the use of web application firewalls

#49

Post by KronisLV »

There was a point in the article about WAFs being quite slow, in particular the article talks about Nginx with ModSecurity.

However, some benchmarks from a while ago suggested that Nginx performs worse with ModSecurity than Apache does in a similar configuration: https://blog.litespeedtech.com/2019/12/02/modsecurity-perfor...

Seems like Coraza also has some more recent benchmarks, since from what I can tell they more or less aim to replace ModSecurity in some regards: https://coraza.io/docs/reference/benchmarks/

I wonder whether anyone has undertaken the effort to compare the performance of the self-hosted WAF options in 2023, or at least in the past few years.

Personally, I think the performance tradeoff might sometimes be worth it if security does indeed improve, the Swiss cheese model (defense in depth) and all that: https://en.wikipedia.org/wiki/Swiss_cheese_model

Re: Discouraging the use of web application firewalls

#50

Post by tehalex »

Agree for our apps.

However, for 3rd party code we run/host but don't really own I see value to a WAF. For example, we unfortunately run WordPress, and I don't have time to manually audit all of the stupid plugins people want to be installed beyond a checker for known vulnerabilities, so a WAF is some comfort/protection.

Post reply on HN