What is our primary use case?
Our main use case for
Cyber Security Cloud Managed Rules is mostly web application because it protects the front end and also with the
CDN we are using it, so it protects the
CDN exposed applications as well.
A specific example of how we have used Cyber Security Cloud Managed Rules to protect our web applications or CDN is that we have a proper dashboard of all attacks that were attempted on those exposed URLs at the application level and we have clear visibility. Whenever there is some type of IP which is trying to DDoS our domain, then it gets automatically blocked and we have configured alerts as well. We do get a consolidated report weekly and monthly that shows a lot of hits, what the IP was, and that it was automatically blocked.
We also have AI workload, so it is important to consider that in our main use case for Cyber Security Cloud Managed Rules. We are catering to that in our workflow and trying to manage it so that even our AI workflows do not have prompt injections or, if we are having agents, we do not get man-in-the-middle attacks with the prompts.
What is most valuable?
The best feature that Cyber Security Cloud Managed Rules offers in my experience is the ability to roll it out in a dry run, which would be a useful way of testing things without impacting real user traffic. After implementing the rules, I would need good observability to get an idea of how effective they are and what I should change to make them better.
Cyber Security Cloud Managed Rules has positively impacted our organization because we are a tech company, so we always prefer to get security first. This is a big thing when it comes to exposing any domain. We would want to ensure that we have secure guardrails around it, and whenever we roll it out, we properly ensure that there was a design doc, there was a review, and make sure that it was behind those security gates to avoid any issues after go-live. It is a proper process that we follow to ensure that no new application sneaks through and before go-live, all these checks are done.
What needs improvement?
Sometimes false positives do come across, and we have incidents where people who are actually trying to access are getting blocked out, which is how I think Cyber Security Cloud Managed Rules can be improved. It is getting better, but sometimes these cases do happen. I would imagine the opposite is also true where there are certain cases where attackers are able to sneak through. For example, we have been using AI workloads and in that, certain times we have had issues where prompt injection can cause problems. We would to incorporate this in all the workflows where we are using AI as well, so possibly more stringent rules around that would be beneficial.
Cyber Security Cloud Managed Rules does the job, and if you have it configured in the correct way as per your requirements, such as IP sets or SQL injection, you are able to get a basic cover, but the workloads are evolving, and I would like to see more flexibility around those rules so that I can make better use of them. Because use cases are increasing, I would to play around with the rules a bit more so that I can say with certainty that my workloads are secure and ingress traffic is secure. That would help me, so I would give a better rating if that can happen.
Cyber Security Cloud Managed Rules are generally stable in my experience, but if a new attack vector rises or if something new comes up, they are not very adaptable, which is my feeling and experience. I would say they are stable, but not very versatile.
For how long have I used the solution?
We have been using Cyber Security Cloud Managed Rules for a good few years because I have always worked in
AWS. We use
AWS WAF and generally at that level, we are protecting all our resources from DDoS and other kinds of attacks, so there are managed rules inside
WAF that we use. We also use
Fastly, and with
Fastly, we get Signal Sciences as a tool, which is a next-gen
WAF that can be used to protect against any cross-site scripting or SQL injection and other kinds of attacks.
What do I think about the stability of the solution?
Cyber Security Cloud Managed Rules are generally stable in my experience, but if a new attack vector rises or if something new comes up, they are not very adaptable, which is my feeling and experience. I would say they are stable, but not very versatile.
What do I think about the scalability of the solution?
I think Cyber Security Cloud Managed Rules are quite scalable, and in terms of the traffic we are getting, they are able to filter out any issues or if it is coming from sources that we do not intend them coming from. They are quite stable and scalable in that sense.
How are customer service and support?
The customer support for Cyber Security Cloud Managed Rules is generally good. It depends on the vendor, which is
AWS when it comes to
AWS WAF and Fastly when it comes to Fastly customer support.
Which solution did I use previously and why did I switch?
I have not used any other solution before Cyber Security Cloud Managed Rules other than WAF and WAF rules. It has always been that.
Before choosing Cyber Security Cloud Managed Rules, I have always used WAF as a web application firewall and at the network level, we have a network firewall. That is how it has been. At the API Gateway level also we have WAF and even if we expose it via a load balancer, we use WAF. No matter how we expose to the internet, it has always been WAF in the forefront. WAF rules are the thing we have always used.
What was our ROI?
I would say time saved is a big metric as a return on investment with Cyber Security Cloud Managed Rules because we are not always looking for things manually or stopping attacks manually. This is helpful because we have automated WAF rules, so they obviously come to the forefront and help protect us against any of the attacks. That is a time save. We have alerts configured if there is an issue. We do not have to manually go and find out about those issues; we usually get an idea of what is going on. A big benefit would be time save, which in engineering can be converted to money saved as well.
What other advice do I have?
In terms of how I use dry run mode and observability with the managed rules, we implement it in a count mode. We will only not block any traffic, but just get a count and get an idea of how the rule would work. Observability-wise, generally in Fastly CDN, we do get a dashboard of how the traffic is getting served. If there is some kind of suspicious IPs or any IP set which is coming from a certain country which we do not want the traffic coming from, then it gets blocked. We have proper visibility.
I think the AI space is something really big right now, so I would to see some improvements around those lines.
I am not one hundred percent sure if we purchased Cyber Security Cloud Managed Rules through the AWS Marketplace. We may have, but I have not looked into that.
I have not been involved in the pricing, setup cost, and licensing phase for Cyber Security Cloud Managed Rules. It usually comes via procurement, so I am not involved in the licensing side of things because I am mostly technical and I am someone who implements things. I have not come across looking at the pricing, licensing, or setup cost.
I would give Cyber Security Cloud Managed Rules an overall rating of seven.