Here at netnea, our job is to help customers run and manage their ModSecurity / OWASP CRS based WAFs. Right now, the migration of existing installations to CRS 4 is a major concern for many of them. And it rarely comes alone: There are business constraints, tight schedules, a lack of resources (and in-house know-how), […]
This is the third and final blog post of a three-part series describing the new CRS-upgrading-plugin. In the previous two posts I introduced the new plugin (part one) and covered the technical implementation details (part two).This post walks through a real-world migration at one of our enterprise customers and the experiences gathered during the shift […]
Damiano Esposito of ZHAW and I run a little test project where we want to measure the effectiveness of the OWASP ModSecurity Core Rule Set 3.0 (CRS3) under attack by several security scanners. The testing is only about to start, but I would like to document the setup of the ModSecurity server a bit to […]
@avarx_ is part of the Swiss team for the European Cyber Security Challenges and also a member of the TYPO3 security team. I joined with him to start a set of TYPO3 rule exclusions for the OWASP ModSecurity Core Rule Set 3.0 (short CRS3). This is a set of rules to be deployed on a WAF in order to […]
The new Core Rule Set 3.0 (CRS3) release simplifies ModSecurity/Drupal integration tremendously. Here is a guide aimed at the Drupal community to learn how to work with ModSecurity. This guide and the rule file it is based on currently covers Drupal Core. Modules / Plugins are not yet supported. But count on the Drupal community […]
