DeCaPa (Community Member) asked a question.
How would you answer this question? The question was asked of me and I didn't feel like I articulated it adequately, in part because AppSec is way more than just capabilities provided by a WAF. But how best to answer?
I found myself stating things like "improving code quality", "preventing vluns from making it into prod", "not all attacks can be stopped by a WAF", and "defense in depth principles". I also spoke to cultural and devops aspects to producing a secure and high quality product for our customers.
Sometimes we get stuck in the minutiae of integrating security tools, passing policy scans, mitigating flaws, etc, that we occasionally get questions like this that we may not be prepared to answer adequately. How would you answer? 🙂
.png){kind=logo}
Having spent a lot of time with pentesters, I know that WAFs are incredibly easy to bypass. They are mostly deployed for compliance (e.g. PCI DSS) but are not very effective for a skilled, targeted attack. Here are some links to help you read up on this topic:
https://www.1337pwn.com/guide-identifying-bypassing-wafs/
https://owasp.org/www-community/attacks/SQL_Injection_Bypassing_WAF
https://medium.com/@Pentestit_ru/bypassing-waf-4cfa1aad16bf
https://medium.com/secjuice/waf-evasion-techniques-718026d693d8
Also, there are often changes in network architecture, rule sets, and it's difficult to set up effective WAF rules that cover all cases. It's always safer to eliminate the root cause of a vulnerability than to put a bandaid on it that "may" work.
WAF is a "safety net" and may provide "virtual patching" until the application code is fix...and like mentioned above they can easily be bypassed. A misconfigured WAF will also bring a false sense of security. A well configure WAF will provide more time for developer to fix their code.
I do get this question now and then. Using a WAF alone is a poor excuse for ignoring "Build Security In" principles and leads to developers thinking 'someone else' is taking care of their application's security. We all know that's nonsense - the only people who can appropriately secure an application are the people who write it - there's no magic using technology.
It's vital to impress upon those who ask the question that even if a WAF is configured 100% correctly and catches and stops attacks it knows about successfully and every time, it's still at risk for letting new attacks through, including zero-day attacks. With Web Services and API communications as the most likely future form for all apps, WAFs will become less and less useful. What will survive in this new world are well-written, high-quality, resilient applications that can stand up to endless attacks.
Some great answers here. There's a quick high level blog post I wrote a few years ago on the Veracode blog that might be sharable to address this question: https://www.veracode.com/blog/intro-appsec/application-security-i-have-waf
Thanks for the excellent talking points and links. They greatly helped with a deeper understanding of WAF's and their place in application security.
If there is additional info to share, I'd love to hear more about it. --thanks
Although I am only a backend dev I would argue that like every other program also a WAF can have bugs and misconfigurations which might make it easy for attackers to bypass it.