Core Rule Set for the Masses
summary
Verizon Edgecast documents running ModSecurity + OWASP CRS across thousands of servers in 100+ locations, migrating from CRS 2.2.9 to 3.0 and using paranoia mode and anomaly scoring to tune detection. Alert-only profiling (e.g., during a sale) finds false positives so teams apply targeted rule exclusions by argument or cookie instead of disabling rules. Result: a rollout that drops an observed 45 million monthly alerts to a few thousand—noise reductions of up to 90%—while keeping blocking thresholds conservative.
AI-written summary · about
chapters (29)
- 0:00Intro
- 0:59Agenda
- 1:28Verizon Edgecast Network
- 2:32Web Application Firewalls
- 3:39WAF Benefits
- 5:29Mod Security - A brief history
- 6:22Mod Security Architecture - Two Components
- 7:47ModSecurity Principles
- 9:09Mod Security Capabilities
- 10:55Performance Considerations
- 12:39Response Time Test
- 13:08Limitations
- 14:18WAFs Are Essential
- 15:20Set Your Expectations
- 15:37Know Yourself
- 16:56Know Your Adversary
- 17:16Know Your Environment
- 18:01Let's NOT Abandon WAF
- 18:51Core Rule Set (CRS)
- 20:52The Holy Grail of Fine-tuning
- 21:47Fine-tuning Your WAF
- 22:55Anomaly Scoring in Mod Security
- 23:35Anomaly Scoring Explained
- 24:49Keeping the Wall Bulletproof
- 25:53Safe Exclusions
- 26:56Exclusion Example
- 27:50Cookie Exclusions
- 28:47Core Rule Set 3.0
- 30:02Paranoia Mode
related talks
41mPractical OWASP CRS In High Security Settings
29mFlagship Projects: ModSecurity Core Rule Set
53mWhat's New in CRS4: An Update from the CRS Project
40m'The Rise And Fall' Of ModSecurity And The OWASP Core Rule Set
53mOWASP Coraza: Open Source WAF for Cloud Native Service Mesh
46mIt is rough without a WAF
54mOvercoming The Inundation Of Noisy Security Alerts
32mOWASP Coraza - Web Application Firewall