A Web Application Firewall (WAF) raises concerns that it does not fit into the DevOps methodology. The problem is that when a WAF is added to production, the impact on the application is tested too late. The application developer gets extremely late feedback and the WAF could break the application. This can lead to production issues. But what if a WAF is involved in the DevOps process very early on and not just at the end, at production?
The organisation of the CRS community summit at the OWASP AppSecEU conference is coming along nicely. Remember, we are going to meet in London on Wednesday, July 4 at 4pm, to talk about CRS, and about the way our users, our integrators and their users work with CRS. The program will include information about CRS 3.1, a recent proposal for a rule meta language above CRS (to give the rule set a wider audience) and the most important thing: Time to meet and talk to fellow users!
The OWASP ModSecurity Core Rule Set project will meet on Wednesday July 4, at 4pm in London to hold it’s first community summit. We scheduled this for the night before the AppSecEU conference in London on Thursday and Friday so people would have a real incentive to make the trip. {{ figure src=“images/2018/03/16367769605_dec3772aa8_k.jpg” caption=“London Tower Bridge by night (Photo by Arijit_Roy; flickr)” >}} Truth be told, the three project leads, Chaim, Walter and me have never met in person and physical contact is similarly rare between the committers, let alone the commercial suppliers or the thousands of users worldwide.
This is the CRS newsletter covering the period from Early February until today. We held our monthly community chat. We had quite a few people stop by. csanders lifeforms franbuehler emphazer dune73 agi squared fzipi spartantri Our agenda from before the chat is available here. During the chat we discussed the following: We added support for ModSecurity-v3/Apache and Modsecurity-v2/Nginx to the CRS Support ModSecurity Docker Repos. These will be used when testing before a release. Additionally, we will be adding testing with Nginx+FTW in addition to Apache+FTW.
So many technologies in one title! Recently I’ve been spending quite a bit of time investigating ModSecurity as a potential replacement Web Application Firewall, and I’ve had some really positive results. The purpose of this post is to share with you how I’ve set this up, so you can do something similar yourself. After all, who wouldn’t want to be alerted to suspicious behaviour on their site in slack:
To help our customers secure their sites and applications — while continuing to give their users reliable online experiences — we’ve built a performant, highly configurable, and comprehensive Web Application Firewall (WAF). In our last post, we shared some of the tech behind our WAF, including how we chose our ruleset and leverage our findings. In order to provide a fully comprehensive solution for securing your infrastructure, it’s critical to continuously test that solution. Because technology and threats are constantly evolving, the rulesets also need to evolve to ensure proper visibility and mitigation into emerging attacks methods.
This is the CRS newsletter covering the period from Early January until today. We held our monthly community chat. We had quite a few people stop by. csanders airween franbuehler lifeforms spartantri dune73 allanbo Our agenda from before the chat is available here. During the chat we discussed the following: Issue #989 status: Currently waiting on canders to fix Dockerfile before it can merged. The Dockerfile’s point to csanders-git’s personal repository instead of CRS repo. This is done in error. csanders will change config default for docker to build on ubuntu and not fedora.
This is the CRS newsletter covering the period from Early December until today (Now in 2018, Happy New Year!!). We held our monthly community chat. We had quite a few people stop by. Special thanks to lifeforms for leading the chat. csanders fzipi spartantri dune73 emphazer fgs franbuehler Our agenda from before the chat is available here. We had a short chat, during the chat we discussed the following: The OWASP CRS Mailing list seemed to be broken for a bit, we confirmed that it is currently working, and who the administrators are (dune73, lifeforms, and csanders) csanders committed to making changes to FTW necessary to get azhao155’s PR’s (and #989 which deals with FTW) merged. A number of folks are testing the Java protections PR that is slotted for 3.1 The Java rules (#990), that are a key feature of 3.1 need some attention We’d like to see correct formatting before merger And a number of FTW tests added for it. There was interest expressed in a format checker script A reminder the required format is available via https://github.com/coreruleset/coreruleset/blob/v3.1/dev/CONTRIBUTING.md OWASP_TOP_10 tags are outdated with new release and will be updated as part of rule cleanup 2.0 The older versions are available here: https://github.com/coreruleset/coreruleset/blob/95e7e6b3982eca93989c7948faca4a961737eace/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf A new ticket will be opened taking into account discussions from https://github.com/coreruleset/coreruleset/pull/881/files Dune73 will review #983 and #982 and merge if ready. csanders will write some of the documentation from #986 and provide a space on coreruleset.org for the information to live. #974, which deals with transfer encoding, is awaiting a PR, this change requires both correctly evaluating the TE RFC and the extensions. For 3.1 we’re going to do basic abuse checks in PL and any extension checks will be in PL minimum with further review planned for 3.2. We’d like to add the PR for CPanel exclusion to 3.1, due to how CPanel sets up their system it causes false positives, ideally CPanel would fix this but they haven’t yet so we’ll add a class exclusion similar to how we did with WordPress, Drupal, etc. emphazer said he could take this on. We reviewed spartantri’s idea for filetype checking based on STREAM_INPUT_BODY. It is unclear if this feature will be exposed as part of libmodsecurity. A PR will be prepared with the known compatible stuff enabled and the other stuff commented out and possibly enabled over time. Dune73 discussed a project for a volunteer who would shift rules that only require Phase 1 variables to use the phase:1 action for performance reasons. AppSecEU has been moved from Israel to UK and shifted to match the dev summit two weeks earlier. This would thus be perfect for our planned little CRS summit. @dune73 is in charge of this. dune73 is doing a ModSec/CRS/NGINX webinar with O’Reilly on January 9. Subscription is free, the slides will be shared afterwards. The next community chats will be held on the following dates:
Let me put one thing straight: there are two things when we talk about ModSecurity. There is the naked ModSecurity engine running inside NGINX or Apache and there is the rule set that instructs the engine what to do. Many different rule sets exist. But the rule set with the largest user base (and longest name) is the OWASP ModSecurity Core Rule Set or CRS for short.
Back in August and September, Chaim Sanders introduced FTW, a Framework to Test WAFs via two blost posts. Existing unit testing frameworks are not really suitable for this purpose as they do not grant you enough control over the requests and the ability to look at the WAF log that needs to be bolted on. Chaim teamed with Zack Allen and Christian Peron from Fastly to create this. So FTW was developed with exactly our use case in mind. Time to really understand this and to start using it.