Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Currently i have deployed ModSecurity as a reverse proxy for providing application layer security. Now i want to write application specific rules for all the web application i am protecting i.e. Positive/Negative Security Model for Web application. My question and doubts are

Is there as template for writing security profiles for Web application i.e security policy regarding application specific parameters, application specific headers and application structure ? In short using this profile i want to write WAF rule and track changes i.e. if Web application is enhanced with some new features then what are the risk. I also want to share this profile with my client for compliance.

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

You might have heard of this.There is a mod_security rule set provided by OWASP. This rule set is to protect from the top 10 attacks listed by OWASP(you can download from OWASP website)

share|improve this answer
    
Yes i have installed ModSecurity CRS. These are actually templates rules and require significant client side tuning and tweaking for good performance. –  Ali Ahmad Jan 18 '13 at 11:36
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.