In a layered enterprise security architecture with a Web Application Firewall (WAF) deployed in the DMZ, should there be shared responsibility between the WAF and application layer/ microservices for mitigations the WAF supports, specifically for mitigations against Bots?

While one can argue defense-in-depth mandates application-level hardening, relying on application developers who typically develop business logic to write something for bot mitigation (which requires expertise beyond app dev) can be impractical and introduce overhead.

If the WAF offers bot defense as a built-in feature, should the application layer also implement bot mitigation techniques like fingerprinting? What are the best practices and guidelines for allocating responsibility for mitigating threats between WAF vs application?

  • 1
    There is no generic "bot defense" which is common to all WAF and provides perfect protection. If you need additional protection in your application depends if the protection offered by the WAF is sufficient or not for your specific use case. But it makes likely no sense to implement exactly the same logic the WAF already offers in your application. The idea of defense in depth is more about defenses complementing each other, not replicating each other. Commented Apr 28 at 16:31


You must log in to answer this question.

Browse other questions tagged .