What are security best practices to determine if WAF should redirect Internet traffic to cloud network as encrypted or unencrypted ?


Best practice is to encrypt all traffic - especially if it touches any network equipment you do not entirely control.

If the WAF is on a different LAN to the server network why would you not encrypt it? If your servers accept unencrypted traffic it to a large extent makes the WAF redundant - a malicious actor could just send the traffic direct.

There have even been instances of security agencies accessing traffic within internal communications. Google now trust absolutely nothing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.