GRC Cybersécurité 14 points
WAF & Bot Management Review
Cette liste de contrôle est en anglais.
Reviews web application firewall and bot management deployment covering coverage, rule tuning, bot mitigation, monitoring, and evasion resistance.
OWASPPCI DSSNIST 800-53
PDF ou Word gratuit · saisissez votre e-mail pour le télécharger.
Coverage & Deployment
- Are all public-facing web applications and APIs protected by the WAF? *
- Is the WAF operating in blocking (not just detection) mode for production? *
- Is TLS inspection configured so encrypted attacks can be inspected? *
- Is direct-to-origin access prevented so traffic cannot bypass the WAF? *
Rules & Tuning
- Are managed rule sets covering the OWASP Top 10 enabled and current? *
- Are custom rules tuned to reduce false positives without weakening protection? *
- Is virtual patching used to mitigate known application vulnerabilities pending code fixes?
- Is rate limiting configured for sensitive endpoints (login, API, checkout)? *
Bot Management
- Are automated bots classified and malicious bots (credential stuffing, scraping) mitigated? *
- Are challenge mechanisms (CAPTCHA, JS challenge) applied to suspicious traffic?
- Are good bots (search crawlers) allow-listed to avoid business impact?
Monitoring & Response
- Are WAF and bot events logged and forwarded to the SIEM? *
- Are alerts configured for spikes in blocked attacks or new attack patterns? *
- Is rule and policy effectiveness reviewed periodically against evasion techniques?
Téléchargez la liste de contrôle WAF & Bot Management Review complète
Obtenez-la gratuitement en PDF propre et imprimable, ou en document Word modifiable.