Skip to main content
Information Security

Return to Answer

added 128 characters in body
Source Link
YaronGo
YaronGo
  • 11
  • 2

What could be a consideration is that, even with a secure connection between Client->WAF, and then WAF->Your server, the WAF by definition has access to the raw request/response. In a case where data security (for example healthcare, finance) requires full encryption in transit, this is a big loophole, and essentially potentially provides a third party with access to the data.

Edit: My above discussed cloud WAF, and as such the concern that a third party has potential access to the unencrypted data.

What could be a consideration is that, even with a secure connection between Client->WAF, and then WAF->Your server, the WAF by definition has access to the raw request/response. In a case where data security (for example healthcare, finance) requires full encryption in transit, this is a big loophole, and essentially potentially provides a third party with access to the data.

What could be a consideration is that, even with a secure connection between Client->WAF, and then WAF->Your server, the WAF by definition has access to the raw request/response. In a case where data security (for example healthcare, finance) requires full encryption in transit, this is a big loophole, and essentially potentially provides a third party with access to the data.

Edit: My above discussed cloud WAF, and as such the concern that a third party has potential access to the unencrypted data.

Source Link
YaronGo
YaronGo
  • 11
  • 2

What could be a consideration is that, even with a secure connection between Client->WAF, and then WAF->Your server, the WAF by definition has access to the raw request/response. In a case where data security (for example healthcare, finance) requires full encryption in transit, this is a big loophole, and essentially potentially provides a third party with access to the data.