NGFW & WAF

Controls whose failure a party outside your team would notice: a non-exportable hardware key, a witnessed generation ceremony, an issuance log held append-only by another owner, and name constraints the auditor can read for themselves. They buy detectability, not impossibility.

Not from an outage — traffic keeps flowing and the application keeps working, so a transparent device leaves the path silently. You find out only from positive evidence that judgment is still happening, per path: a marker the origin can check, judged-request counts compared with served-request counts, and a probe that must be blocked.

Do not spend the window discovering what breaks. Run the policy in log-only mode first, build the destination inventory from records the gateway already produces, enforce in rings, and agree revert criteria in writing beforehand.

Not from resolver logs alone — they cannot show a host that asked somebody else. Join the querying sources to the asset inventory, add egress records for other resolver destinations, and make the endpoint prove the path.

The denominator must cover every egress path and come from a source independent of the inspection device, or you divide what the device saw by what the device saw. Paths crossing no control are uncounted, not unread.

An agent on the host gives each session its own source-port range and reports which range belongs to which user. The firewall attributes a flow by source port, not address; anything outside a range maps to nobody.

Stop selling a fleet-wide level. Measure both prices per route, the CPU per request and the legitimate requests refused, then buy paranoia level 3 only where warranted and hand finance priced options with the refusal count attached.

Treat it as an ownership and contract problem, not a rule problem. Name an internal owner with a dated review, get a testable build and a reproducible test written into the supplier agreement, and put the residual risk in front of whoever owns the partner relationship to accept in writing with an expiry.

The default is a risk acceptance, not a technical preference, and a provider cannot accept risk for a customer. Aim at per-tenant defaults: deny for new tenants from onboarding, a dated migration with a log-only phase for the rest, and a named tenant signature on every allow.