Loading…
This event has ended. Create your own event → Check it out
This event has ended. Create your own
View analytic
Friday, September 22 • 11:30am - 12:15pm
Core Rule Set for the Masses

Sign up or log in to save this to your schedule and see who's attending!

Feedback form is now closed.

Everyone who has used, or attempted to use, OWASP ModSecurity Web Application Firewall knows something about fine-tuning rules. ModSecurity Core Rule Set (CRS) was designed to catch more, show more and let you decide what to do with security alerts. It is a time consuming -- and often frustrating -- exercise to analyze alerts, separating the wheat from the chaff, and determine which are candidates for blocking.

 

With thousands of servers at more than 100 locations, Verizon Edgecast CDN is one of the world’s largest deployment of OWASP Core Rule Set. We will share our experience in fine-tuning the CRS for a large number of customers, adjusting to their taste in risk and attitude toward false positives. We will discuss lesser used features of ModSecurity to cut down noise levels in alerts, sometimes as much as 90%. We will also discuss our experience in moving from CRS 2.2.9 to 3.0 which was released in late 2016.

 

We hope that the audience will walk away with understanding benefits of using the venerable web application firewall with the latest enhancements and issues to consider to get the most out of it. Ultimately, we hope that our experience will make your task of fine-tuning the CRS a little easier.



Speakers
avatar for Robert Whitley

Robert Whitley

Security Solutions Architect, Verizon Digital Media Services
Robert Whitley started out his career as a customer facing SOC analyst that allowed him to explore the breadth of the information security field. After working closely on incident response and threat intel, Robert now spends his day to day on consulting users on WAF and rate limi... Read More →
avatar for Tin Zaw

Tin Zaw

Volunteer, OWASP
Tin Zaw currently co-leads the OWASP project on Automated Threats to Web Applications, along with Colin Watson. At his day job, he leads a global practice to help Verizon customers secure web properties at Verizon Digital Media.  | He started his career programming network pro... Read More →


Friday September 22, 2017 11:30am - 12:15pm
Coronado H

Attendees (23)