NGFW & WAF

A stopgap WAF rule changes nothing about the bug. The code is still vulnerable; only requests matching that pattern, arriving through that proxy, are stopped. It costs a permanent rule nobody owns and a fix that stops feeling urgent.

Software learns a proxy from an operating-system setting, a PAC file located by WPAD, or proxy environment variables. An agent with a hard-coded destination reads none of them, so you write a direct-egress exception every process on that host inherits.

A server segment talks to a finite, owned set of destinations that changes under change control, so it can be enumerated. A user population needs the whole internet, so no allow-list holds. Malware landing there leaves unblocked.

The endpoint has to send that query to your resolver. A filtering resolver is a control the client opts into: a host that asks a different resolver, or ships its own, is never offered the block.

Identifying an application needs evidence, and the evidence is the traffic itself. The device reassembles and inspects the opening bytes before it can commit to a name, so those packets have already reached the far end when a deny finally fires.

A root your devices trust covers any hostname, not only the sites you inspect. Whoever holds its key can impersonate any site to your fleet, so you now run a certificate authority and must guard the key like one.

You keep the destination address and port, packet sizes, direction and timing, plus an outer name identifying a shared front rather than the real site. The true server name is gone, and TLS 1.3 encrypts the certificate too.

Only that some identity source associated that address with a user earlier, and the association has not yet expired. The packet itself carries no identity, so whoever is using that address next inherits the name.

Each matching Core Rule Set rule adds points by severity (critical 5, warning 3, notice 2); the request is refused only when the total reaches the inbound threshold, 5 by default. Every point added to it is attacker headroom.

Set it below the shortest interval in which an address can change hands. Too long and the next holder inherits the departed user's rules and name. Too short and you evict live users into the unknown-user rule.

A narrowly scoped exclusion, that rule on that path for that one parameter, gives an attacker least: every other rule, route and field keeps its protection. Dropping the fleet level or raising the shared threshold weakens everyone.

Every Core Rule Set rule carries a paranoia-level tag, and the configured level decides which rules run at all. PL2 adds looser-fitting rules that catch obfuscated payloads PL1 misses, and those same rules match legitimate requests too.

A rule built from one captured sample encodes the attacker's spelling, not the bug. The same input re-encoded, moved into a body the proxy does not parse, split across parameters or sent to another route gets through. Widening the pattern buys false positives on partner traffic you cannot test.

Redirection helps only where the client tolerates interception. Pinned certificates, client-certificate authentication and non-HTTP traffic on 443 fail outright; QUIC on UDP/443 is untouched. Each failure ends in the per-device exemption an implant can use.

A deny record proves a host tried to reach a destination the allow-list does not contain and that the packet was dropped. It does not prove malice, carries no payload, usually carries no hostname, and stays silent about everything the list already permits.

Because the canary is a request that only cooperating software honours. A browser checks that name and voluntarily falls back to the system resolver; an implant with a hard-coded DNS-over-HTTPS endpoint never asks, and never sees the signal.

Everything transferred under the first label. A re-label re-runs policy on a flow already in progress: the device can tear the session down from that moment, but the bytes that moved while it was called ordinary traffic are delivered and unrecoverable.

Each entry is a permanent unread path, and the list only grows because removal means proving nothing breaks. An intruder just picks a destination already covered: the bypass verdict uses the name the client claims.

Decide the posture before the incident, because during it you have a DNS TTL you cannot shrink retroactively, an attacker already engaged, and an irreversible act: publishing the origin address cannot be undone. Choose in advance between staying degraded behind the edge and a fallback position you already run.

Only request-level evidence counts: with the rule bypassed, the fixed build must reject the archived incident sample and its variations on its own. Release notes and a quiet partner are not evidence. It costs a testable build from the vendor, an archived sample, and a window in which you carry the risk.

Narrow it on every axis the filter offers - one source address, the vendor's actual destinations, one port and protocol, a schedule if the agent has one - then build the watch on flow records and handshake names, since no proxy log exists.

Stop enumerating destinations and enumerate paths instead: deny direct outbound from that segment and permit only the inspected proxy path plus the few internal services it needs. You buy one choke point with identity and a record rather than denial, and you pay in capacity, failure posture and exceptions.

DoT is cheap to block: it has its own port, 853. DoH hides on 443, so you hold an address list that is never complete, breaks software quietly depending on a public resolver, and never reaches a self-hosted endpoint.

Rank by volume and endpoint pair, then read host role, who owns the far end, byte direction and session shape. That narrows the candidates but never names them: a flow record carries no payload. The application's owner names it; you record it.

Name constraints bind the validating client, not the CA. A compliant validator rejects excluded names, and a key thief cannot strip the constraint from the copy already in your trust stores. Non-enforcing clients and unconstrained name types get nothing.

They can impersonate sites to any managed device, on any network, with no warning. A root cannot be revoked, since clients never check revocation for a trust anchor, so recovery means removing it from every trust store.

Three options, each with a bill: deny UDP/443 and force fallback, which breaks clients that cannot; allow it unread, making that path the preferred one; or inspect QUIC, paying capacity and state broken by connection migration.

Neither blanket allow nor blanket deny. Detect the stall, freeze existing mappings instead of letting them expire, and send unattributed traffic to a designed restricted policy rather than to a catch-all nobody chose.

Fix the queue, not the rule. A nine-day turnaround turns every deadline into an escalation, and escalations are granted by people who never read a rule base - which produces the permanent broad permit the policy existed to prevent.