CirrostratusHi,
What if I apply all signatures to all ASM policies applied to different different VS. I know it would cause utilization issue but apart from that is there anything i need to know?
CirrocumulusMy thoughts are you're increasing the prospects of false positives as you're protecting against attacks that are not relevant. For instance a windows based attack when your backend infrastructure is *nix based.
This will cause more admin too to sort out.
Anyway, my 2c.
N
CirrostratusJust to add some points, i would always sit in the middle of positive and negative security model. In the context of web apps POSITIVE security model is deny all, allow only what is known to be good. NEGATIVE security model allow all, deny only what is known to be bad. As Nathan stated when you go with only one model (signature) you are going to deal with a lots of burden on you !
Cirrostratus