Главная
Study mode:
on
1
intro
2
preamble
3
about joshua fox
4
doit
5
article
6
scenario
7
what is a waf?
8
drivers for getting a waf
9
hacker attack
10
penetration test
11
urgency
12
expertise
13
outside requirement/audit
14
security blanket
15
web threats
16
walktrhrough: cross site scripting
17
wihout waf
18
demo waf architecture
19
make it safe!
20
a simple chat message is executed
21
with waf
22
sql injection
23
ddos
24
why distributed?
25
application-level threats
26
broken access control
27
toss in a waf
28
how cloud armor works
29
architecture
30
policies and rules
31
rules
32
types of rules
33
preconfigured rules use these!
34
sensitivity paranoia
35
standard signatures
36
sample signature
37
rule language
38
waf won't protect you!
39
blocking your own app
40
false positives
41
job zero
42
secure your app
43
but the most important
44
ddos
45
ip address
46
geo
47
dry run
48
preview
49
problem with preview
50
false negatives
51
imperfection detection
52
the worst: broken access control
53
attackers shift
54
attackers are smart
55
flexibility?
56
waf adds risk, man-in-the-middle
57
risk: complacency
58
risk to performance
59
pricing
60
at long last...
61
eternal requirement
62
third-party apps
63
central supervision
64
the one go-to feature
65
consider advanced services
66
if you're going to do it, do it now
67
prefer your cloud's waf
68
minuses of waf
69
plusses of a waf
70
conclusion
71
we're hiring!
Description:
Explore the controversial topic of Web Application Firewalls (WAFs) in this 27-minute conference talk from Conf42 SRE 2024. Delve into the drivers for implementing WAFs, including hacker attacks, penetration tests, and compliance requirements. Examine common web threats like cross-site scripting, SQL injection, and DDoS attacks, and understand how WAFs attempt to mitigate these risks. Learn about WAF architecture, policies, and rules, including preconfigured options and custom rule languages. Critically analyze the limitations of WAFs, such as false positives, potential for blocking legitimate traffic, and the risk of complacency. Discover alternative approaches to application security, including secure coding practices and advanced cloud services. Evaluate the pros and cons of WAF implementation, considering factors like performance impact, pricing, and centralized security management. Gain insights on when to consider WAF deployment and how to choose the right solution for your needs. Read more

When Not to Use a Web Application Firewall and Its Alternatives - Lecture

Conf42
Add to list
#Information Security (InfoSec) #Cybersecurity #Web Security #Web Application Firewalls #Network Security #Ethical Hacking #SQL Injection #Access Control #Application Security #Programming #Cloud Computing #Cloud Armor
0:00 / 0:00
1 of 71

intro