Don’t use a WAF, and when you should, anyway.
summary
Argues WAFs like Cloud Armor stop some attacks — demo shows it blocked XSS and flagged SQL injection signatures — but causes false positives that break bug reports and forums, false negatives when attackers pad payloads, and adds cost and latency. Recommends dry run preview to tune rules, a central team to manage policies, and using a WAF mainly for third‑party apps or real DOS protection. Core claim: WAFs are a stopgap, not a substitute for fixing broken auth and application code.
AI-written summary · about
chapters (8)
- 0:00Introduction and problem scenario
- 4:43What is a WAF and how it works
- 11:55Common web application threats
- 17:14WAF rule types and complexity
- 24:43False positives and negatives risks
- 31:47When a WAF is actually useful
- 37:49Conclusion and security mindset
- 40:20Q&A session
related talks
46mIt is rough without a WAF
14mWeb Application Firewalls: A False Sense of Security?
40mWAF Made Easy
27mSecuring Applications and Managing WAFs at a large scale
43mMaking WAF Mainstream: From Static Defenses to... (Roy Weisfeld, Surya Pentakota)
40mWeb Application Firewalls: Analysis of Detection Logic
38mWAFs! WAFs! We don't need no Stinkin' WAFs! Extending WAFs at the Application Layer
38mWeb Application Firewalls Revisited