WAF
Web application firewall
A proxy or module that inspects HTTP traffic and blocks requests that match attack signatures or anomaly rules, such as those of the OWASP Core Rule Set. It can buy time against known exploit patterns but can be bypassed, and it does not fix the vulnerability.
- Defined in
- NIST glossary: Web Application Firewall
Covered in
Operate edge rules without hiding application defects
Tune WAF and abuse controls against legitimate traffic, parser behavior and measurable business effects.
Respond to an exploited or malicious dependency
When a dependency vulnerability is being exploited, or a package version is malicious, triage gives way to incident response: find every running copy, contain it, patch and redeploy, hunt for exploitation, rotate secrets and close on deployed evidence.
Map PCI DSS Requirement 6 to engineering practice and evidence
Turn PCI DSS v4.0.1 Requirement 6 into engineering work: secure development, review, patching, web-attack protection, payment-page script control and change management, with the records an assessor samples and the parts that became mandatory on 31 March 2025.
Practice: Local project: Repair a real proxy and shared cache