2020-02-04, 12:20–12:45, B. Con
Web Application Firewalls (WAF) often raise concern about false positives, latency and other potential production problems. In addition, it is often said, that DevOps and WAF do not fit together. That is a pity, since the WAF helps to protect us from web application attacks, like those described by the OWASP Top Ten. But what if you could ensure that introducing and using a WAF went smoothly?
I will show how to integrate a WAF with WAF testing automation into a continuous integration (CI) pipeline. This pipeline ensures that developers receive early and often feedback about their WAF, saves them time and headaches down the line. In fact, DevOps, testing and automation only make sense if all components are part of the process.
Needless to mention, I as an OWASP Core Rule Set (CRS) developer and enthusiast introduced the CRS to Puzzle ITC when I joined them in 2019!
By providing YAML templates, we want to make it easy for developers to introduce WAFs into projects.
Franziska is currently working as an architect for the Swiss company Puzzle ITC, where she combines her passion for IT-security, DevOps and open source software. She is highly experienced in reverse proxy platform and WAF (web application firewalls), from her extensive experience at the Swiss post and as a co-developer of the OWASP ModSecurity Core Rule Set (CRS). As part of the OWASP DevSlop team, she integrated CRS into DevSlop's pixi-crs module, a Continuous Integration pipeline, to provide developers the chance to tune their WAF earlier in the SDLC. She also blogs, speaks at conferences and provides technical training at conferences. When she isn't disassembling highly optimized regexes or studying technical books, she enjoys spending time with her family.