WAFs, What Are They Good For?
Get ready for episode number 3 of our video series called API Security With A Pinch Of Salt. In this episode, Adam and Chris answer the question – WAFs, what are they good for?
The first dedicated WAF was introduced to the market in 1997 by Perfecto Technologies with their AppShield product. Perfecto, renamed as Sanctum, is also credited with defining the first top ten list of web application hacking techniques which, at the time, included:
- Hidden field manipulation
- Cookie poisoning
- Parameter tampering
- Buffer overflow
- Cross site scripting (XSS)
- Backdoor or debug options
- Stealth commanding
- Forced browsing
- Third party misconfigurations
- Known vulnerabilities
This list evolved into the OWASP Top Ten, first published in 2003, and since then we’ve seen both the Top 10 and WAFs evolve to keep up with the latest and greatest threats to applications over the years.
Fast forward to 2019 and the OWASP community decided that API vulnerabilities are unique enough that it was time to define a Top 10 list specific to API-based applications and API Security.
So the question is – how does the WAF stand up as APIs have increasingly become the centerpiece of applications and a primary target for attackers? Check out the video to hear what we think and let us know your thoughts in the comments below.
*** This is a Security Bloggers Network syndicated blog from Salt Security blog authored by Chris Westphal. Read the original post at: https://salt.security/blog/wafs-what-are-they-good-for
