Flagship Projects: ModSecurity Core Rule Set
summary
A ready-to-run rule set on the ModSecurity engine that removes common automated exploits: a Burp test of ~4M requests drops ~80–90% of reported weaknesses (≈1,000 alerts down to 40 root causes) and default installs block ≥80% of web attacks, rising to ~95–99% at higher paranoia levels 1–4. Features include anomaly scoring, sampling mode for incremental rollout, a plugin mechanism, an active duty support rota, and issue counts reduced from ~150 to ~27 while staying in active development.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 0:25What is CRS
- 1:05Safety belts
- 2:35ModSecurity
- 3:34Burp
- 6:30Other Numbers
- 8:44Story
- 14:25Paranoia Levels
- 17:10Animal Scoring
- 17:38Sampling Mode
- 18:52Project Overview
- 20:47Devon Duty
- 22:06Developer Retreat
- 22:57Current Development
- 26:39Summary
- 27:30Resources
- 28:20Sponsor
- 28:33Outro
related talks
41mPractical OWASP CRS In High Security Settings
35mNever Walk Alone: Inspirations From a Growing OWASP Project
40m'The Rise And Fall' Of ModSecurity And The OWASP Core Rule Set
37mCore Rule Set for the Masses
53mWhat's New in CRS4: An Update from the CRS Project
40mWeb Application Firewalls: Analysis of Detection Logic
46mIt is rough without a WAF
18mModSecurity