0:03My name is Billy Hoffman, I'm the field CTO at IONX. My name is Justin Tibbs, I'm the Vice President of Cybersecurity at Presidio. And IONX and Presidio have been working together for about a year now and a big thing we have seen, a big belief of ours is that we're sort of entering the golden age of the WAF with Frontier models. Frontier models are sort of driving down how quickly we can find and build payloads for vulnerabilities, but change control is still gonna change control and it tends to take a long time. And so our hypothesis is that web application firewalls offer a really great opportunity, sort of like deploy a virtual patch while you actually fix the underlying issue. But that then led to something that Justin and I found, which is there's the reality of running a WAF posture management program at scale, and there's the theory, and those two are very, very far apart.

0:57Do you guys all run WAF? That's impressive. All right, this is going to be great. Also, I've always been paranoid that I say WAF, strangely, and people are like, no, you have to spell it out, so. Does anybody spell, serious question, does anybody say W-A-F? Dan, you don't count. You're weird anyways. You're peculiar. My vocab F says peculiar. Clearly none of you have been on a call with Oracle before. or they have or they or they have and they're forgetting it all right let's go yeah so i thought it would be fun to start off with some falsehoods that people tend to think about with wafts okay i think i think the first one i would start off is that a waft is a binary thing right they're like uh is that behind a waft and it's like okay well a thing can be behind a waft but you know that doesn't mean that like it's protected right is the waft there but not on is the WAF actually in logging mode versus blocking mode uh great there's a WAF there but like have you guys ever seen that meme of like the um the the picture of like the gate but there's no fence on either side of the gate there's just tire tracks of people going around the gate uh I see this a lot of time with WAFs where it's like cool the WAF's there and it's working great but like I can just talk directly to the origin so who cares so WAF being a binary thing is a real common one that I see I think you guys can all part relate to it. I'm old.

2:20So I referenced the Ronco commercials with the chicken cooker where you set it, forget it. Yes, I'm old. That to me, like when I talk to clients, they're like, oh, my WAF, it's running. It's good. Falsehood, right? That one is always humorous to me, especially when we're going to talk about app acceleration and dynamic development and all the crazy things that happen with libraries. We don't just set these things anymore. Maybe back in, there's no one from Imperva in here, is there? Maybe back in like 1985 with an Imperva laugh where we just installed. didn't hope it ran that might have been a thing so yeah exactly there's there's certainly drift and then also i think just the the fact that like you can have a couple of core rules right that when mod security came out in what was that 2005 2004 somewhere around there it was like we're having 1500 2000 2500 cvs a year and now we crossed 100 000 in september which is sort of terrifying um another one that i think is is pretty pervasive is that the security team always owns the WAF.

3:21How many people here are responsible for the WAF? How many of you are in security as well? I saw some hands go down. This zone is interesting and I think it sometimes can sort of be what was the initial acquisition of this product, right? I often will find a CDM team inside of marketing owns the Cloudflare. you know like portal access or you know akamai portal access or what have you because originally they bought as a cdn or they got it because you know cloudflare traditionally has that really great like automatic front -end optimization stuff for images and such so someone outside of security buys it and then security is like oh cool here's a control we can use but it's like do you know all of the cloudflare like accounts because rarely there's just one do you have access to everything are are you making sure that everything's all turned on so who actually has access and sort of owns the budget item for it is often interesting, too.

4:16And along those lines, a false, which we'll talk about, is how many of you guys have a WAF program? Or is it just random?

4:27Thank you, Brave Soul, for raising your hand. I deployed an app that's behind the WAF. I deployed the WAF. The app is behind the WAF. Let's go, right? So having a programmatic approach to that is oftentimes lacking. This actually, I think, is... Actually, a great way to kick it off is we try to think about a maturity curve, a maturity model of adopting a web application or a WAF posture management program. And what do I mean by a WAF posture management program? It's simple stuff like, do you have a policy about what should or should not be behind a web application firewall? I've talked to some companies who are just like, oh, we have a policy. Our policy is a very large airline in a city in a city. South, where I live, told me, oh, everything needs to be behind Akamai. And it's like, have I got news for you?

5:14Because you have a whole bunch of assets and a lot of them are not behind Akamai. So they'll say everything that's public or they'll say anything that has a login page. So I think that's sort of a first step is how many people sort of have a defined policy or a guideline of like, if it's public and it has blank, it has to be behind a WF. Awesome. Okay. Getting started. I often find that that can sort of just planning that out can be a bit of a stipping point. So I feel like crawl is really awareness of, do I know what I have? Do I know what is public? Do I have an idea of what should or shouldn't be behind a WAF? And do I know where my gaps are? And I think we'll talk about this, but I think a lot of people, you know, this isn't a much like WAFs not being binary.

6:01The maturity model isn't binary. I see some people who have some. parts of the walking phase and then some of the crawling phase walking so crawling is sort of like awareness of the problem and understanding where the gaps are i like to describe it as that scene in the wizard of oz when dorothy goes through the door and it's like before you had visibility into everything that was public and what is not actually in compliance you live in the sepia toned world of everything is great i mean you're on a farm and it's the dust bowl so i mean that that sucks but you're in your own microcosm and everything's fine but then dorothy goes through that door and realizes oh crap there's a whole nother world over here and all sorts of wild colors and i had no idea that this was here and i feel like that really marks the the sort of acknowledgement of the the crawl piece is wow there's this is a much bigger world than i realized walking is really when you start saying okay great like what we want and what the reality is are different let's start to build a plan to bridge it and it tends to be let's build down a list of like zones we need on board, like a burn down chart.

7:01We're actually starting the process. But I think the difference between walk and run is sort of the realization that it is a program. I'm so glad you use this, Justin. It's not a point in time. It's not an audit. Here are all of the things we have. Here are the things that need to go behind a WAF. Okay, cool. We're done. No, because while you were doing that, you know, your company bought another company that has a whole bunch of stuff you didn't know about or marketing just spun up a bunch of things for an event and they never told security about it. So you have sort of this, the running phase is really realizing, no, no, no, this needs to be sort of a repeatable, sustainable system that has proactive notifications of when new assets appear that are out of compliance or when you have drift and things like that.

7:46So this I think is in a nutshell, sort of the maturity model. Justin, I'm interested when you talk to customers, where do they? tend to be on this are they yeah yeah so I was gonna I was gonna ask because it's this is an interesting thing for me so my background's export development and somehow I figured out how to build companies but um scope is always fun for me um because every client I talk to is like we have 15 external assets and then I'm like oh that's sounds great 150 external assets is probably more realistic and so that's often the to the point of crawl That's often the piece that's very fascinating is to really understand because we develop in such, especially today, we have so many, and I hate the term citizen developers, but we have them, right?

8:33We have codex, we have cloud code, we have, you know, workers, right? I can deploy to a worker rapidly pretty quick within five seconds with the CLI command and be up and running, right? And so now I have a web asset that potentially is outside of the scope of the WAF. So under crawl, what's interesting is figuring out like, what is your external asset scope? Do you actually know? what it looks like. And to your point, is it actually behind your WAF programming, right? Because oftentimes we find even within Presidio, we have 1200 full stack developers and I always have to go and say, yo, you just put a new web asset online, right? I can see it, right? So I have that visibility program and that's the piece I think is really important here. We have to have a program, but in that program, I need to understand what's out there so I can put it behind the WAF program.

9:21that may be, right? Whatever you're trying to do there. And we'll talk a little bit more shortly about the acceleration of that and why. We talked about this earlier with exploit development and automated machine response, but a lot of our clients don't really have, someone used security scorecard. How many of you guys have used that? Or what's the other one? They're all kind of tragic. BitCite, BlackEye, third-party risk management. They'll totally hate me for that, but I think they're quite tragic. There's like a lot of deprecated data on there. They associate things to you that are not yours, all that kind of stuff. So actually figuring out how to walk your infrastructure and understand what you have is going to be... important to understanding how you put things into crawl and then get to walk right that's actually a really good point let's kind of hop into crawl and like uh both justin and i are aggressively not salesy no so i i mean we we both have companies i'm from ionix he is from presidia we both have booths we would love to talk to you more but like this is not about trying to sell our products this is about raising awareness so everything you're going to see on these slides it's not about like you're using xyz products we sell like that that's not a mark of maturity and anybody who's telling you it is is trying to sell you snake oil uh so really the way i like to think about this is like capacities what is a capability uh that an organization has and so being i think one of the critical ones for understanding scope is being able to see your entire public facing attack surface and that doesn't mean these are the ip blocks we own okay cool marketing spun something up on you know wp a third-party WordPress host or something like that, like that's not all of your public-facing assets.

10:49Or people will say, oh, well, I log into Cloudflare or Akamai or Imperva, if we're going to talk about them. And I look in my console and that's my attack surface. It's like, no, that's the stuff you know about that's already in there. That's not actually everything that's public. So defining scope is really a key part of that. And then I think a key part of this also is we started to talk about this as defining a policy. What do you as an organization want to protect? Something actually I find that helps people accelerate this just at is a lot of people, how many people here have sort of inside their application or inside their company, like tiers of apps? Like these are our tier one, most important apps. These are our secondary ones. This is really common, especially on the IT side, usually in regards for like disaster recovery, business continuity, maybe number of nines of availability.

11:37You're like, these are our critical things. Like our supplier portal cannot go down or we lose money. but like if our marketing site has some downtime or it takes longer to restore, less important. I often find organizations can sort of use these existing inventories potentially to sort of understand, okay, well, maybe everything that's a tier A app that has a login page or maybe has PII or confidential data, that needs to be behind. And then essentially there's sort of a diff. It's like, okay, well, if I have the ability to see everything that's public and I have the ability to understand this is what should be behind a WAF, I can just look at the Dell. and understand, okay, here's what I should focus on. And one of the key parts here is also having process. You know, we keep talking about a program, just someone in the security team or in the WAF team having a spreadsheet or a diagram saying in compliance, out of compliance.

12:28Okay, that's great, but that's not operationalized. So you need to start like documenting, hey, department, when you bring a new asset online, here's how you decide whether it needs to be behind. waffern on here's the process for requesting access because if you don't do that early on you're just making the problem bigger you'll start running towards uh walk and run but like it's a leaky bucket every while you're doing all that other parts of the organization are onboarding assets but they're just growing the pile of stuff that's out of policy yeah i do want to highlight just from an attacker perspective like i was a developer in a past life i get it um when you bring something online or when a developer bring something online, we see it really quick. If it has a certificate, we see it really fast, right? I can go scour the internet and find every certificate associated with your domain name or any of your entities within 15 seconds.

13:18It's really fast, right? I can scour DNS records and see every new DNS entry that comes up in your asset class, right? And so the assumption of like, nobody knows it's there, I think is also misleading. I hear that a lot of times from developers, like I just put it up there. Great, I found it. really fast. agents that do that did that, right? And so I think that it's more critical today than ever to realize that the minute an asset goes live and if it has a DNS entry, a certificate entry, or anything that hits some sort of public facing scenario, we will find it really fast if we want to. I'm so glad you brought this up. How many people know what certificate transparency logs are? About half of you. So certificate transparency logs actually largely through a lot of work Cloudflare has done is every time a certificate authority cuts a new certificate. for a domain, or even if you're using Let's Encrypt, it's sort of a public append-only ledger of all of the certificates.

14:09So there's a really great site, crt.sh, that lets you search certificate transparency logs. And I can just be like, I'm from Atlanta, so okay, Coca-Cola. Search for all certificates issued to asterisk.coke.com. And it's like, oh, beverly .staging .testing .someweirdkubernetescluster .com. Like, you'd think it's... It's not public, but it totally is. Yeah, wildly so. All right, so implementing the plan. So just because you understand what's out of compliance,

14:39that's okay. But let's say, I mean, for any sufficiently large organization, it is often hundreds of things that are supposed to be behind a WAF that aren't. And so there's this aspect of like, how do you prioritize them? How do you see people do? Because you help a lot of people on board big Cloudflare installations. Yeah, a lot of it is criticality, right? And there's talking about the programmatic approach of it. Like it's an education first, even with our developers, we made it very clear, hey, I will find whatever you put. If you put it in GitHub, I'll find it. If you have a new worker, we'll find it, right? And so we have a program that searches every day, a program with policies, with technology, I should say, that says, okay, every day we're looking for our own assets. We're looking for new assets, depending on these types of classes, whatever they are. And then we're inventorying them. Then we're going back to the team and saying, hey, this is out of compliance. You didn't actually register this with us, whatever it may be, on our digital side of that.

15:26house, right? So we can keep track of all of our assets. From there, we can create criticality. And this is what our clients do as well. Once you understand your asset inventory, you can say, hey, you know, this app isn't actually anything other than like, I built a webpage to test some new whatever. It's not as critical and it's isolated compared to my coke.com asset, which is probably my bread and butter and my biggest brand, right? And so being able to understand the business impact of the web asset or the asset that's external is the biggest piece of what goes behind the WAF quite. and then the ATT&CK classes and ATT&CK paths that can come at that asset at any type of speed as well. So we see that kind of prioritization, but again, if you don't understand what your teams are putting out, we've seen instances where developers have put stuff out with passwords and AWS keys, for example, into a worker, and there was something they just stored for their own thing.

16:15And again, we discovered it in 15 minutes, and I had someone's domain credentials into AD. That's not exactly... fund, right? And so again, figuring out like what you have is the first thing and then figuring out the criticality of those assets and then where they get placed into the actual structure. And I feel like we could literally talk for 45 minutes about this and we got to go fast. I do think another key port here is that you're moving from coverage to efficacy. So Cloudflare is a great example. I would say Akamai is as well. There's a difference between sort of an enterprise grade WAF that's doing, yeah, it's going to block attacks, but it's doing bot manage. it's doing geofencing, it's doing rate limiting versus, you know, hey, I'm running mod security locally on a proxy. So the next part I think is the preventing drift and also dealing with emerging threats, which is what I wanted to get to most importantly. Okay, cool.

17:04If we got 100 ,000 CVEs this year, are my WAF core rule sets blocking any of that? First of all, does any of that affect me? But how do I? make sure that this WAF that I've deployed is actually blocking those attacks. How do we deploy custom WAF rules in a multi-WAF environment? Like this definitely becomes challenging without documentation and a very purposeful construction. Yeah, what's really interesting in here, do any of you guys have your own harness for vulnerability testing or? A harness around like an agent? Around a transform model? buddy. All right. All right. Cool. If you have your own, I'll give you an example of what we do on some clients too. You have a harness. A harness looks for vulnerabilities.

17:51It looks for web app issues. It doesn't look for standard OS things. It looks for contextualized craziness and business logic, whatever it is. Right. And we have massive apps that go through, even if you're not using a harness, using, I don't know, your SAS DAS tools, right. To your point of like this, this type of exposure. You can use an agentic function to auto -populate a WAF role at speed. Right. LLMs are As much as they're annoying, they're also fantastic. You can have a Claude model, an open, you know, GLM 5 .3 model, pick your poison, actually create a WAF rule on the fly. And we do this a lot for our clients. We do this internally for us, where our models actually will find a threat and then we call it virtual patching. They'll actually write the WAF rule on the fly for the issue and issue it to our threat engineers and say, this needs to be implemented.

18:38Can you double check it? Because we don't blindly trust everything as we shouldn't. And then that. engineer says, yeah, this is a great deploy. And it deploys. And we can do that within under five minutes, right? Or another option here is deploy right away, but deploy it in logging mode and let it soak. And the really cool thing here is that I think a lot of times as WAF people, we are hesitant to deploy custom WAF rules because the ramifications of being wrong is blocking legitimate traffic, which depending on the app costs you money. And then business person comes and yells at you and business person is scary. So people. tend to shy away from that. But the really cool thing about if you're using LLMs and you're doing very exacting testing, I'm not applying a rule at the zone level. I'm saying for this particular asset, for the CVE that just came out last week, it has a very specific GNOME payload.

19:26Let's put a WAF rule in place and flip it into blocking mode and block it. And then, yeah, let's go actually do the thing we need to do to fix this thing, update the software. If it's an app security issue, you know, stop exposing your settings. file maybe like those are all key but our our thing here is that like this can be automated but to do this you need to have WAFs deployed you need to understand where your gaps are you need to work to reduce those gaps and then start to actually plumb this into a more automated system yeah I think we're kind of out of time at the moment it's the fastest speed talk ever we obviously could talk for like 65 more minutes on this but but that's essentially it right the key premise here is like WAF is the Ronco set and forget it is old. Everything is dynamic. Everything is running fast. Everything is being agenticized. Is that a word? I made it up. I don't know. My vocabulary app will tell me no later.

20:15So I can create exploits and I can write attacks on the fly. So I need to be able to remediate on the fly or at least virtually patch on the fly. So you should start taking advantage of using these types of agentic functions to automate threat detection engineering in the WAS. Exactly. That's a big piece. And so we have two things. One, just a quiz that you can use to of self-assess where you are at that chart and get other information. We did this analysis across hundreds of Fortune 1000 companies to essentially get what's hard data. How often is a WAF in logging mode instead of blocking mode? How often is it actually, there's still an exploitable issue behind a WAF there? Like having data is the only way we can get better and actually implement policies like this. Thank you all very much.