0

Currently i have deployed ModSecurity as a reverse proxy for providing application layer security. Now i want to write application specific rules for all the web application i am protecting i.e. Positive/Negative Security Model for Web application. My question and doubts are

Is there as template for writing security profiles for Web application i.e security policy regarding application specific parameters, application specific headers and application structure ? In short using this profile i want to write WAF rule and track changes i.e. if Web application is enhanced with some new features then what are the risk. I also want to share this profile with my client for compliance.

Improve this question

1 Answer 1

Reset to default
2

You might have heard of this.There is a mod_security rule set provided by OWASP. This rule set is to protect from the top 10 attacks listed by OWASP(you can download from OWASP website)

Improve this answer
1
  • Yes i have installed ModSecurity CRS. These are actually templates rules and require significant client side tuning and tweaking for good performance.
    – Ali Ahmad
    Commented Jan 18, 2013 at 11:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .