Practical OWASP CRS In High Security Settings
summary
CRS 3.2 plus ModSecurity on Apache proves able to stop active testers even when backend code is broken: Burp sends 4.5 million requests, default CRS already removes most LFI and XSS and greatly reduces SQLi, and a 900-attacker bug‑bounty yields only 16 findings with highest severity low. Practical ingredients are ModSecurity 2.9 on Apache, paranoia level tuning (150 rules → ~200 at higher levels), anomaly scoring to iterate from monitoring to blocking, and fail2ban integration to cut off scanners.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:44Welcome
- 1:14What is a Web Application Firewall
- 2:05What is ModSecurity
- 4:35CRS
- 13:42High Security
- 17:31High Security Findings
- 21:10Logging
- 22:25Tutorials
- 23:09Animal Scoring
- 31:24Fail to Ban
- 35:08Whitelisting
- 38:23Additional Rulesets
related talks
40m'The Rise And Fall' Of ModSecurity And The OWASP Core Rule Set
53mWhat's New in CRS4: An Update from the CRS Project
29mFlagship Projects: ModSecurity Core Rule Set
37mCore Rule Set for the Masses
52mPractical Security in Web Applications
59mPractical Security for Web Applications
08mPractical web security
40mWeb Application Firewalls: Analysis of Detection Logic