Re: parsers fall down go boom?

[Tracy Reed <treed () ultraviolet org>]

On Thu, Aug 06, 2009 at 03:36:40PM -0400, dave spake thusly:
> Lemme tell you, there's nowhere a hacker would rather be than on
> your WAF. If for no other reason than the irony, because hackers
> have good senses of humour.

I have been wondering about this very thing. NIDS don't bother me so
much because it is usually on a mirror port and not really directly in
the flow of things. A little harder to get ahold of and less
useful. But a WAF...that's a different story. And things like PCI-DSS
6.6 require code review (expensive and a pain) OR a WAF (which nearly
everyone chooses). I have never liked to deploy WAFs instead
preferring to attempt to write more secure code although
defense-in-depth etc can't hurt. But I have actually heard webapp
developers use the WAF as a crutch ("Learn parameterized queries? But
we have a WAF!").

-- 
Tracy Reed
http://tracyreed.org

Attachment: _bin
Description:

_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
http://lists.immunitysec.com/mailman/listinfo/dailydave