Web Application Firewalls Explained

This week we are joined by Michael Collins, Principal Consulting Solutions Architect at Barracuda, to explain what a web application firewall (WAF) is and how it differs from a network firewall. Along with Nate, CIT's Director of Cybersecurity, we explore how WAFs help defend websites, web apps, and APIs against threats like injection, bot attacks, brute force attempts, and DDoS, especially as AI “vibe coding” leads to insecure public-facing applications. The episode covers choosing basic vs enterprise-grade WAF protection based on business criticality and sensitive data, tuning to reduce false positives using detect vs block modes and staged deployment, visibility into daily attacks, geofencing and IP blocking, and how WAFs support compliance efforts like PCI and HIPAA as part of a broader security strategy.

00:27 What Is a WAF

03:58 Defining Web Apps

07:41 APIs and Vibe Coding Risks

11:12 Choosing the Right WAF

14:31 Tuning and False Positives

20:52 Onboarding Detect to Block

28:06 Compliance and Regulations

31:48 Visibility and Geofencing

38:13 DDoS Story and Wrap Up

42:54 Testing and Deployment Options

46:35 Final Thanks and CTA

Check out more from Barracuda