Looking to implement some additional mod_sec rulesets on our server. OWASP and Atomic keep coming up as the best of the best. Would it be wise to implement both? Or, would one or the other be sufficient for PCI compliance?
Do not implement both. Is useless. Using the both rule sets is a waste of CPU and memory, because both of them are overlapping.
PCI Compliance require a WAF in some cases, but doesn't specify exactly the functionality. Almost all auditors will look to see if the WAF is protecting you from SQLi, XSS etc. which, in this case, any of the rule sets will do this job.