Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Currently i have deployed ModSecurity as a reverse proxy for providing application layer security. Now i want to write application specific rules for all the web application i am protecting i.e. Positive/Negative Security Model for Web application. My question and doubts are

Is there as template for writing security profiles for Web application i.e security policy regarding application specific parameters, application specific headers and application structure ? In short using this profile i want to write WAF rule and track changes i.e. if Web application is enhanced with some new features then what are the risk. I also want to share this profile with my client for compliance.

share|improve this question
up vote 2 down vote accepted

You might have heard of this.There is a mod_security rule set provided by OWASP. This rule set is to protect from the top 10 attacks listed by OWASP(you can download from OWASP website)

share|improve this answer
Yes i have installed ModSecurity CRS. These are actually templates rules and require significant client side tuning and tweaking for good performance. – Ali Ahmad Jan 18 '13 at 11:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.