Meet the WAF Squad | Impart Security

<

div class=”text-rich-text w-richtext”>

Introduction

Web applications and APIs are critical parts of your attack surface, but managing WAFs has never been easy.  False positives, rule tuning, risks of production outages, and log analysis – all of this work has made WAF historically difficult to operationalize.

Well, that time is over.  Meet Impart’s WAF Squad – a five-member squad of AI assistants superheroes dedicated to making web application security not just manageable, but downright fun!

In this blog post, you’ll see why these Assistants aren’t just toys —they’re here to revolutionize how you protect your apps and data – IN PRODUCTION.

WAF his a hard space to play

WAF has always been a historically challenging space to work in because of the intersection of multiple personas within a organization.  Unlike other appsec tools like DAST, which are primarily controlled and managed by the application security team with very few other stakeholders, WAF has many stakeholders with different focus areas and priorities.  WAF historically has impacted SRE teams, software engineers, architects, SOC teams, as well as application security teams.   One tiny mistake by any of these teams can have a huge impact on all of them, which carries significant risk.  That’s why so many organizations get so little value out of their WAF, with most of their rules turned off or in non-blocking mode.

‍

At Impart, we have decades of operational experience working with all of these types of teams across hundreds of customers, along a wide range of production environments.  Over the years we’ve been able to identify most of the common operational and implementation pitfalls associated with each persona and have developed playbooks and tactics to still be successful.

Team of Assistants approach

Many companies in the information security space have different types of assistants and chatbots bolted onto their SaaS offerings.  These assistants have largely been gimmicks, not trusted enough to do anything in production.  The most egregious I’ve encountered are AI chatbots which summarize developer documentation for security teams, which is a solution in search of a problem and doesn’t consider the different

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.