Web Application Firewalls Explained

This week we are joined by Michael Collins, Principal Consulting Solutions Architect at Barracuda, to explain what a web application firewall (WAF) is and how it differs from a network firewall. Along with Nate, CIT's Director of Cybersecurity, we explore how WAFs help defend websites, web apps, and APIs against threats like injection, bot attacks, brute force attempts, and DDoS, especially as AI “vibe coding” leads to insecure public-facing applications. The episode covers choosing basic vs enterprise-grade WAF protection based on business criticality and sensitive data, tuning to reduce false positives using detect vs block modes and staged deployment, visibility into daily attacks, geofencing and IP blocking, and how WAFs support compliance efforts like PCI and HIPAA as part of a broader security strategy. 00:27 What Is a WAF 03:58 Defining Web Apps 07:41 APIs and Vibe Coding Risks 11:12 Choosing the Right WAF 14:31 Tuning and False Positives 20:52 Onboarding Detect to Block 28:06 Compliance and Regulations 31:48 Visibility and Geofencing 38:13 DDoS Story and Wrap Up 42:54 Testing and Deployment Options 46:35 Final Thanks and CTA Check out more from Barracuda