ModSecurity / OWASP CRS

Why This Course is for You

• Don't spend ages trying to figure out ModSecurity yourself — learn all the tricks with this practical course from a top ModSecurity expert
• Everything from how to install ModSecurity to how to take security of your applications to a new level
• Gain insight into ModSecurity blacklisting and whitelisting
• Learn how to set up the OWASP ModSecurity Core Rules
• Learn how to extract the information from the server and analyse it without ever leaving the shell

Course Outline

1. Setting up Apache
1. Compiling apache yourself
2. Minimalistic Apache configuration
3. Walk through the configuration
4. Extending the logfiles
1. IO and performance data
2. GeoIP information
3. TLS protocol and cipher
4. ModSecurity infos
5. Data extracting done fast
6. Basic statistics on the data
2. Setting up ModSecurity
1. Compiling ModSecurity yourself
2. ModSecurity base configuration
1. Rule Engine
2. Audit Engine
3. Request limits
3. First Steps with ModSecurity
1. First rules
2. Full transaction log
4. ModSecurity Blacklisting (negative security model)
5. ModSecurity Whitelisting (positive security model)
6. Enabling the Core Rules
1. Introduction to the Core Rules scoring concept
2. A slightly different approach to their base config
3. Testing core rules in action (includes attack scanner)
7. Tuning the Core Rules
1. Identify false positives
2. Tune away the false positives
3. Calculated approach to setting the scoring limits
8. LogFile visualisation
1. Histograms of traffic data
2. Bell curve distributions in the shell
9. Reverse Proxy setup
1. Setting a standard Reverse Proxy
2. Introduction to some ModRewrite Voodoo
3. Apache Proxy Balancer
4. Combining ModRewrite and Proxy Balancer
10. Effective debugging
1. The 4-shell setup
1. Config window
2. Controlling Apache
3. HTTP requests with curl
4. Logfile monitor
2. Customizing the setup for your environment
11. Open discussion

Bring your ideas and problems to the course and we will discuss them together.