Currently i have deployed ModSecurity as a reverse proxy for providing application layer security. Now i want to write application specific rules for all the web application i am protecting i.e. Positive/Negative Security Model for Web application. My question and doubts are
Is there as template for writing security profiles for Web application i.e security policy regarding application specific parameters, application specific headers and application structure ? In short using this profile i want to write WAF rule and track changes i.e. if Web application is enhanced with some new features then what are the risk. I also want to share this profile with my client for compliance.