manilatimes44d ago
ONCE digital transformation is in motion, application sprawl and application programming interface (API) growth tend to follow. Few organizations make meaningful progress in their digital journey without expanding both along the way. Maintaining the security and reliability of these assets is not something to leave to chance. It takes careful planning and deliberate investment. The International Trade Administration projects the Philippine cybersecurity market to grow by 13 percent and reach $387.10 million by 2028, a clear sign that companies are doubling down on protection. Government support is also reinforcing this push for better cybersecurity. For example, the Department of Information and Communications Technology’s National Cybersecurity Plan (NCSP) 2023–2028 provides a roadmap for organizations not only to keep their digital systems secure but also to build a culture that keeps security top of mind. While it is tempting to think that spending more on security automatically means better protection, reality is never that straightforward. If organizations do not have a clear understanding of how their cybersecurity tools actually work in practice, they risk overspending, misusing resources or overlooking critical gaps and weak points. One of the clearest examples can be seen in the management — or mismanagement — of web application firewalls, or WAFs. WAFs are an effective way to protect important applications and sensitive data from threats such as malware, identity spoofing and zero-day exploits. However, if the wrong WAF is chosen or it is set up and managed poorly, it may slow development, create bottlenecks, frustrate teams and place a heavy strain on resources. To avoid these headaches, security teams should be aware of three common pitfalls in evaluating and deploying WAFs. These lessons often apply to other areas of security as well. 1. Prolonged evaluation, deployment When adopting or upgrading WAFs, it is not unusual for the evaluation and deployment process to take longer than planned, especially when lengthy proof-of-concept exercises or complicated procurement procedures are involved. For WAFs that use AI or machine learning, the initial learning period can slow things down even further. In the meantime, applications remain unprotected. Delayed deployment may result in missed opportunities. Security teams can avoid these issues, or at least minimize them, by clearly defining evaluation criteria, deployment goals and success metrics from the start. It is also important to engage vendors early, not only to review technical requirements but also to discuss legal considerations and potential roadblocks to avoid delays later. Without careful planning and strategic oversight, WAF expenses can also get out of hand. Organizations must account for staffing, support fees, site downtime, overages and professional services, since all these contribute to the real total cost of ownership (TCO). 2. Underestimating total cost of ownership Some WAFs can tie up multiple team members just to manage rules, monitor alerts and address false positives, while others are so inflexible that taking advantage of cost-saving options such as edge computing or serverless architectures becomes difficult. Support is another area to watch. Slow response times or restrictive service-level agreements (SLAs) can create additional security gaps and financial strain. This is where teams can get caught off guard, especially when unplanned costs appear outside the security budget. Input from site reliability engineers, DevOps, incident response and customer support teams matters because they experience the operational impact firsthand. Security leaders can also review vendor SLAs, read peer reviews and consult independent assessments such as Gartner Peer Insights to gain a more complete picture. When teams understand the actual work involved in running a WAF, there will be fewer budget surprises down the line. 3. Impeding agile development, DevOps practices Teams are moving faster than ever with agile development, but friction anywhere in the software life cycle can bring progress to a crawl. A common source of friction is outdated or inflexible WAFs. For instance, rule updates may disrupt applications or false alerts may block legitimate users, leaving development and security teams spending hours finding a fix. WAFs should serve as protection, not obstacles. Organizations need WAFs that integrate smoothly with existing workflows, keep pace with DevOps practices, automate rule updates and can be deployed flexibly wherever needed so teams can focus on building instead of firefighting. Aligning security with business objectives With economic pressures on one side and cyber threats on the other, organizations need to examine closely where their security spending goes. Security investments only pay off when protection does not come at the expense of day-to-day operations. When a core part of the security stack such as a WAF is outdated or poorly managed, the impact can have organization-wide consequences, especially in terms of rising costs and growing frustration across teams. This is why CISOs who understand the hidden costs of WAFs are choosing modern solutions built for automation and agility to avoid these common pitfalls and make smarter investment decisions. Threats do not wait, neither should your teams National efforts such as the Philippines’ Digital Infrastructure Legislation and the NCSP 2023–2028 mentioned earlier mean that securing applications and APIs will be central to building trust and supporting a resilient economy. A modern, next-generation WAF does more than help teams stay ahead of evolving threats. It also helps them keep work moving smoothly and use resources efficiently while giving customers and stakeholders confidence that the organization is secure. Rachel Ler is the area vice president for Asia at Fastly, a cloud computing and edge cloud platform company focused on content delivery, cybersecurity and application performance. Its services are widely used by media companies, e-commerce platforms, streaming services and technology firms to speed up websites and applications while improving security and reliability.