Trustwave and Cybereason Merge to Form Global MDR Powerhouse for Unparalleled Cybersecurity Value. Learn More
Get access to immediate incident response assistance.
Get access to immediate incident response assistance.
Trustwave and Cybereason Merge to Form Global MDR Powerhouse for Unparalleled Cybersecurity Value. Learn More
One of the major improvements in the next release of ModSecurity (v2.0) will be the support for a positive security model. Even now, with its flexible rule language, ModSecurity supports the positive security model. But there are areas that are not covered (e.g. automated policy generation is difficult to achieve) so I have decided to provide a complete solution for this problem.
I have been looking at the possible solutions for a positive security model for some time now. There are three ways to solve the problem:
I have decided to start with the first option, mostly because this approach is easy to understand and allows whitelists to be created and/or updated manually. Furthermore, it may be possible to get the developers to distribute positive security model configuration files with their applications. Automated tools may be used to create these files in the first place. Below is a quick overview of what I have in mind:
A full XML-based configuration file example is available here.
Trustwave is a globally recognized cybersecurity leader that reduces cyber risk and fortifies organizations against disruptive and damaging cyber threats. Our comprehensive offensive and defensive cybersecurity portfolio detects what others cannot, responds with greater speed and effectiveness, optimizes client investment, and improves security resilience. Learn more about us.
Copyright © 2024 Trustwave Holdings, Inc. All rights reserved.