Securing Applications and Managing WAFs at a large scale
summary
SBB runs an automated, policy-driven WAF fleet that blocks real exploits and buys patching time: ~200 WAFs on AWS are managed via AWS Firewall Manager + Terraform with a centrally stored default policy and narrow per-app exclusions. Standard OWASP/CRS rules already stop path traversal and many RCEs (including a disclosed RCE scored 9.8) and Log4j patterns; false positives are tuned via GitOps and four-eyes PRs. The system works and reduces emergency outages.
AI-written summary · about
chapters (9)
- 0:00Web app firewall challenges
- 2:11What is a WAF and benefits
- 7:18Why WAFs are essential
- 10:07Real-world WAF protection
- 13:25WAF in defense in depth
- 14:51Managing WAFs at SBB scale
- 21:43WAF best practices
- 24:40WAF learning resources
- 25:47Summary and Q&A
related talks
33mNetwork and application protection on AWS
46mIt is rough without a WAF
40mWAF Made Easy
29mWeb application protection on AWS
33mWAFs FTW! A modern devops approach to security testing your WAF
42mDon’t use a WAF, and when you should, anyway.
14mWeb Application Firewalls: A False Sense of Security?
16mAutomating AWS WAF: Pioneering future security