Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Thoughts on Web Application Firewalls

netspi.com | blog | #secure-coding | #sql-injection | #waf | #application-security | #defense-in-depth

Summary

Pushes back on the claim that WAFs beat fixing vulnerable code: filters can be bypassed, need lengthy tuning, and have their own flaws, so WAFs belong in defense-in-depth, not code substitution.
Published
Collected

original ↗

Related coverage

blog · netspi.com
What's Happening in the Application Security Arena?
According to Gartner, 75% of the attacks are coming though web applications and not through the network. This means greater emphasis needs to be placed on application security. However, this does not appear to be happening.
vulnerability · netspi.com
Is SQL Injection a Terminable Offense?
Reacting to an editorial claiming coders who write SQL injectable code should be fired, the author argues blame extends to architects, DBAs, QA, and decision makers who won't fund real testing.
vulnerability · netspi.com
SQL Injection: Death by Blacklist
No one can deny that SQL Injection is one of the biggest issues plaguing web applications today. However, there is still some ongoing debate around how to fix it.
research · idnsec.com
Mitigating RCE Impact Like in OpenAI Hack with Defense-in-Depth
Using HacktronAI's OpenAI Discourse hack disclosure, this article covers sandboxing, runtime protection, and AI-assisted defense to shrink the blast radius of RCE across interconnected apps.
blog · netspi.com
Rust’s Role in Embedded Security
Rust improves memory safety in embedded systems, eliminating entire vulnerability classes, but logic, hardware, and cryptographic flaws still demand rigorous security testing.
blog · netspi.com
Vibe Coding: A Pentester’s Dream
NetSPI vibe-coded a web app with AI coding tools and tested it for vulnerabilities; the results were mixed, showing why AI-generated code still needs proactive security review.
back