We're exploring a WAF (web application firewall) to mitigate risks during our migration from CF11. In the past, a local firewall solution "broke things" , then the firewall guy left and we gave up. I'm working on getting more detail here. Given this, we're considering a CF-specific WAF, Pete Freitag has kindly offered the hospital a generous discount for FuseGuard. The documentation looks promising. Has anyone here encountered specific CF-related false positives with any WAF they've used? I'm also very eager for specific notes on session management or performance issues.

the biggest issue I have had with WAF is when the application has to support a lot of users that are accessing the application from the same IP (like applications that support call center activity, etc). It looks like you might be a hospital, so if all of the users are going to be accessing the application using the same external ip, then you will want to make sure the IP(s) are in the whitelist so they don't trigger rules about the same ip trying to log in with lots of different username/password combos

We are indeed a hospital AFAIK , our CF apps are all accessible only from the internal network, and everyone connecting has their own their own IP. However, I'm not sure so this will be a good thing to check.

ok, if it is an intranet application then and the server will see all the traffic as comming from unique ips then that is not an issue

I haven't use FuseGuard extensively, but I think if you've run into issues with other WAFs breaking things, you may run into similar issues with FuseGuard. All WAFs will need some amount of tuning, and setting them up to log first (so you can block/tune later) is usually the way to go. Do you have any insight into how the previous WAF broke things? I'm not aware of any CF-related false positives for a WAF. I think you'll find it will be more based on how your application works and what it does behind the scenes. For example, using/tuning a WAF for an application that needs to support file uploads and limited HTML/rich content in user requests (e.g., think ticketing/message board comments) is going to be a lot trickier than using/tuning a WAF for an application where all records are obtained via numeric IDs, and all user-supplied data is also numeric strings (an extreme example, but hopefully illustrative...). WAFs will have a bunch of rules (some based on patterns in the request data, some based on things like Scott's IP-to-user example, and some other things) -- but it's sometimes hard to predict what will/won't break without logging first. And sometimes you'll find if a WAF rule is "breaking" something, it may be an opportunity to clean up some application code that could be done differently/more securely. Good luck!

I'm quite interested in what yer using a WAF for if it's an intranet? Are you expecting many attacks from yer own people? Tough crowd. What am I missing here?

I had the same thought... I am assuming it is HIPAA related

Not sure a WAF is how I'd solve that. But anyway, will wait for a definitive answer.

What a WAF does to your app will highly depend on what the WAF is, what rules are in place, etc. The one we use adds a TON of cookies into the headers and sometimes causes 500 errors in Tomcat because the length of the cookies was too large. Otherwise it should not do anything for properly formed requests, etc.

I have a couple HIPAA applications I have been involved in, and in my experience, It's about auditing yes, but it is also about access control to patient data AND application/hosting security AND data encryption (in transit and at rest) AND code change management control. You need to be regularly evaluating all of these types of things and looking for vulnerabilities that could lead to compromised data. I would imagine they did not pass some scans (likely do to the old version of CF) and are looking to create a band-aid with the WAF while they work on updating CF and securing the actual problems.

@Adam Cameron , @Scott Bennett pretty much calls it. There are a few thousand people on our internal network. It is not inconceivable that one of will eventually be involuntarily hosting somebody else's vulnerability scanner. As I understand security best principles , you expose only what is needed to the outside but you protect internal resources as though they were subject to direct attack. I think the buzz words are "Defense in Depth" @Brian Reilly I'm meeting with the guy that tried the previous WAF on Monday.

:->

@Dan MacNeil I've used Fuseguard on an app that requires HIPPA compliance and I've been very happy with it.