759 karma · joined March 16, 2009
1) Gather requirements of what the business expect the systems to do provide which capabilities for the business to operate and grow for the future.
2) Present this to the generals and ask them "how can we get here with which changes or new systems?".
3) Analyze document the proposed changes outline pros and cons. Make recommendation to CEO.
Repeat the loop again with action plan and timeline, if the CEO agrees which i'm sure the CEO will have input on where action plan is focused on and timelines. Ask for input from all Cxx and SVPs - repeat loop after this point.
Repeat until actionable work items are created and assigned to people to execute on. Monitor execution and keep doing it again and again until all the changes are in.
There are few options on AWS marketplace such as Fortinet and F5 WAF rules. Fortinet is the better of the 2 and newer.
AWS WAF would trigger a false SQL injection attack if the URL contains two "+" chars and the word "and". Or if you have a cookie with JSON in it would trigger the XSS attack rule.
Highly recommend setting up WAF logs to output some logs aggression tool (e.g Splunk) and create reports, dashboard, and alerts about WAF trigger rules & request HTTP code over a span to time and see what is going on with your requests and how WAF is evaluating the requests.
1% of WAF blocks were real attacks, my experience is with a site that had 25 million unique visitors a month (no user content). i'm not saying you shouldn't have WAF, i'm saying nothing beats good visibitily into WAF to correct it behavior over time.
" The tax proposal would apply to just about 700 taxpayers, Democrats say — people who earn more than $100 million per year or who have more than $1 billion in assets for three straight years. It would require them to give the IRS a detailed account of how much the assets they own gained or lost each year, a process called mark to market."