I've spent some time lately in discussions around Web Application Firewalls. WAFs seem to be a hot topic in recent times and with PCI DSS 6.6, many people are now starting to look at these technologies.

Though, with the PCI SSC council watering down the 6.6 requirement, I questioned here whether they were required at all under PCI DSS:
http://tinyurl.com/4rtkdf

I went to town a little on the WAFs here:
http://tinyurl.com/5fac9f

It's interesting though that while opinions vary and may look so opposite to each other, the arguments are not too dissimilar. When I did speak directly with Jeremiah Grossman, we weren't to far off each others wavelength. At the end of the day, it comes down to what fits and is manageable in your environment. If it can work for you and add additional security, and you accept the trade-offs, go for it. Just don't get lulled into that false sense of security so to speak, understand the limitations of WAFs and don't neglect the basics - they are ultimately the key.

No votes yet