Story 2 — Azure WAF / OWASP Disagreement

Use for: customer disagreement, security vs usability, stakeholder management, explaining technical issues simply.

Search keywords: Azure WAF OWASP customer disagreement security trade-off exception

30-second answer

We implemented Azure WAF with OWASP rules for an internet-facing application, but legitimate requests were blocked because the older application did not fully match the expected patterns. I explained the trade-off to the customer and presented two options: change the application or create a narrowly scoped exception. They couldn't change the application at that time, so we used the scoped exception rather than disabling the WAF. The application became accessible while the rest of the WAF protection remained in place.

STAR answer

Situation

We implemented Azure WAF with OWASP rules for an internet-facing application. After go-live, some legitimate requests were blocked. The application was relatively old and some requests did not fully follow the patterns expected by the OWASP rules.

Task

We needed to restore legitimate traffic without simply weakening the WAF protection.

Action

I explained the issue to the customer in non-technical terms. I used a security-guard analogy: the WAF was doing its job, but some legitimate requests were being rejected because they did not match the expected pattern.

I presented two options: modify the application so it followed the security rules properly, or create a narrowly scoped exception for the specific rule causing the problem.

The customer said changing the application was not feasible at that time, so we chose the scoped exception and made the security trade-off explicit.

Result

The application became accessible again while the rest of the WAF protection remained in place.

Lesson

Security is not only about saying no. It is about understanding the business requirement, explaining the risk clearly, and finding the smallest practical exception when full remediation is not immediately possible.

Key phrase

Don't disable the control when a narrowly scoped exception can solve the actual problem.