OM DENNE EPISODE
This week we are joined by Michael Collins, Principal Consulting Solutions Architect at Barracuda, to explain what a web application firewall (WAF) is and how it differs from a network firewall. Along with Nate, CIT's Director of Cybersecurity, we explore how WAFs help defend websites, web apps, and APIs against threats like injection, bot attacks, brute force attempts, and DDoS, especially as AI “vibe coding” leads to insecure public-facing applications. The episode covers choosing basic vs enterprise-grade WAF protection based on business criticality and sensitive data, tuning to reduce false positives using detect vs block modes and staged deployment, visibility into daily attacks, geofencing and IP blocking, and how WAFs support compliance efforts like PCI and HIPAA as part of a broader security strategy.
00:27 What Is a WAF
03:58 Defining Web Apps
07:41 APIs and Vibe Coding Risks
11:12 Choosing the Right WAF
14:31 Tuning and False Positives
20:52 Onboarding Detect to Block
28:06 Compliance and Regulations
31:48 Visibility and Geofencing
38:13 DDoS Story and Wrap Up
42:54 Testing and Deployment Options
46:35 Final Thanks and CTA
