Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What is the best way of testing my Firewall configuration as i have deployed the Core Rule set provided by the OWASP. But my rule configuration was giving me too many false positives which i resolved by deleting many of the rules from the core ruleset. Now that i have deleted some problematic rules how can i now make sure that my configuration is still secure.

share|improve this question
add comment

3 Answers

up vote 4 down vote accepted

Much though some vendors would like you to think that a WAF is - (a) a requirement and (b) a black box you can dump down in front of your webapp to protect it from all possible attacks - it really doesn't work that way. A WAF configuration isn't binary 'secure' or 'insecure'; it will just be more or less effective at addressing particular forms of attack.

So you need to have an idea of what attacks you're trying to prevent so that you can test those. Are you attempting to guard against malformed HTTP requests? Try some. Are you trying to counter invalid UTF-8 sequences? Test it. Is there are a specific application vulnerability that you're trying to block at the WAF as a temporary measure because you can't get the application fixed yet? (This is what WAFs are really good for.)

(Are you trying to guard against application-level SQL injection by filtering out the word 'SELECT'? Then you're pretty much wasting your time. There are a lot of rules like this in the mod_security CRS which are pretty much entirely bogus.)

share|improve this answer
2  
+1 WAF needs training and tuning over time and should be specifically configured for the app its protecting. External rulesets help you think about ways to write your own rules. –  schroeder Nov 1 '12 at 16:05
add comment

One simple way may be to use readily available testing tools such as sqlmap, sqlninja for SQL Injections and XSSer for XSS attack vectors. If any of the vectors weren't caught by the updated ruleset, then you are in trouble. Fix the ruleset accordingly.

share|improve this answer
add comment

You could run a web security scanner against your website and see what vulnerabilities still come up in the report. There are several offerings out there, some are desktop tools while others are SaaS: Acunetix, Cenzic, Qualys, White Hat, IBM AppScan, HP WebInspect.

Better yet if you can afford it, hire a pen-tester to do a security audit of the website. If configuring the WAF is too complex or time consuming I'd recommend looking at Cloud based WAF solutions like Incapsula or CloudFlare.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.