When Not to Use a Web Application Firewall and Its Alternatives - Lecture

intro
preamble
about joshua fox
doit
article
scenario
what is a waf?
drivers for getting a waf
hacker attack
penetration test
urgency
expertise
outside requirement/audit
security blanket
web threats
walktrhrough: cross site scripting
wihout waf
demo waf architecture
make it safe!
a simple chat message is executed
with waf
sql injection
ddos
why distributed?
application-level threats
broken access control
toss in a waf
how cloud armor works
architecture
policies and rules
rules
types of rules
preconfigured rules use these!
sensitivity paranoia
standard signatures
sample signature
rule language
waf won't protect you!
blocking your own app
false positives
job zero
secure your app
but the most important
ddos
ip address
geo
dry run
preview
problem with preview
false negatives
imperfection detection
the worst: broken access control
attackers shift
attackers are smart
flexibility?
waf adds risk, man-in-the-middle
risk: complacency
risk to performance
pricing
at long last...
eternal requirement
third-party apps
central supervision
the one go-to feature
consider advanced services
if you're going to do it, do it now
prefer your cloud's waf
minuses of waf
plusses of a waf
conclusion
we're hiring!