RE: [WEB SECURITY] cross site trace

["Martin O'Neal" <martin.oneal@xxxxxxxxxxxx>]

I'm happy that a WAF can be used as a dynamic patch, but as a general
rule, I don't think they work that well even when used this way (as I've
pointed elsewhere, they are often used to fix encoding issues by data
validation restrictions).  Better than nothing, but not good.

I have no statistics to back it up (tm), but my anecdotal experience is
that companies suffer way more downtime from unplanned or poorly managed
changes than they do from security incidents.  Change control is your
friend.

Martin...

----------------------------------------------------------------------------
Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives:
http://www.webappsec.org/lists/websecurity/archive/

Subscribe via RSS:
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]

Join WASC on LinkedIn
http://www.linkedin.com/e/gis/83336/4B20E4374DBA