Checklist · Edge & WAAP
Go live behind a WAAP without breaking anything
The checks I run for each application moving behind a cloud WAAP, from inventory to blocking mode. They come from onboarding 230+ applications across two programmes.
- 23 checks
- 8 critical
- Saved in your browser
- 0/23
- checks ticked
- 0/8
- critical checks
Before cutover
0/6Cutover day
0/4Lock the origin
0/4Monitor to block
0/6Operate
0/3Go deeper
When a checklist is not enough.
A checklist tells you what is missing. An assessment tells you what it means, what to fix first and what it will cost.
- WAAP & API protection assessmentI review your WAF, WAAP, bot and API controls against your real estate and traffic, then show the gaps, the bypass paths and a safe route to blocking.2–4 weeksFixed fee
- Application architecture reviewI take one application or platform and trace every path from the internet to its data, then show which controls hold, which are missing and what to fix first.1–3 weeksFixed fee
- Edge & WAAPI have onboarded more than 230 applications to WAAP across two programmes. I check what your edge really blocks, what gets around it and how to reach blocking safely.Expertise · Area 01
- Monitoring & visibilityI have piped WAAP logs into a bank’s SIEM and fixed the backpressure that delayed them. I check what reaches your SOC, how fast, and who acts on it.Expertise · Area 04
How long should an application stay in WAAP monitoring mode before blocking?
There is no fixed number of days. An application should stay in monitoring mode until it has seen a full business cycle, including month-end, salary dates and campaigns, because that is when unusual but legitimate requests appear. It is ready to block when its WAAP (web application and API protection) events reach the SIEM (security information and event management) platform, every triggered signature is classified, exceptions are narrowly scoped and the owner has tested key functions.
Is the WAAP vendor’s default policy good enough to go live?
It is a reasonable starting point, not a finished configuration. A default WAF (web application firewall) policy does not know your applications: rich-text fields, JSON (JavaScript Object Notation) bodies and long cookies often trigger false positives, while flows such as login and one-time passwords need bot rules the defaults do not set. Tune each application against its own traffic in monitoring mode, then enable blocking.
Who should run a WAAP migration?
Ravindu Fernando, a Colombo-based application security consultant, assesses readiness and recommends a migration plan first. Delivery can then sit with your own team, a partner of your choice or Innov8’s Application Security Business Unit, which he heads and always discloses. Whoever runs it needs named application owners, access to DNS (Domain Name System) and certificates, and a SOC (security operations centre) that can see the platform’s events.