It is rough without a WAF
summary
2025 shows rapid exploit weaponization and most disclosed CVEs are classic web issues like XSS and SQLi, so a WAF provides immediate, network-wide protection while teams patch dependencies. Claims: an out‑of‑the‑box ruleset mitigates about 48% baseline mitigation and tuned rules reach 80–90%, with virtual patching and anomaly scoring buying time. Coraza is an open source option (Coraza (Go)) focused on performance and extensibility. Real costs are false positives, rule ownership, drift, and the need for continuous tooling and rule specialization.
AI-written summary · about
chapters (11)
- 0:00Introduction and context
- 2:202025 security trends
- 5:01Anatomy of supply chain failures
- 8:46Challenges in vulnerability management
- 14:56Web application firewall basics
- 16:53WAF features and capabilities
- 23:06WAF mitigation strategies
- 28:25Operational challenges of WAFs
- 34:40Introduction to Coraza WAF
- 36:26The future of WAF technology
- 42:09Conclusions and Q&A
related talks
38mWeb Application Firewalls Revisited
42mDon’t use a WAF, and when you should, anyway.
32mOWASP Coraza - Web Application Firewall
55mOWASP Coraza: The Way To WAF In 2023
27mSecuring Applications and Managing WAFs at a large scale
43mMaking WAF Mainstream: From Static Defenses to... (Roy Weisfeld, Surya Pentakota)
14mWeb Application Firewalls: A False Sense of Security?
53mOWASP Coraza: Open Source WAF for Cloud Native Service Mesh