Showing 19 results for: 2005 ×

ModSecurity 1.9 article on O'Reilly Network

My article ("What's New in ModSecurity"), which describes the most important improvements in 1.9, has just been published on O'Reilly Network. It covers the rule engine enhancements, real-time audit log aggregation facilities, and the stateful request monitoring features. It's a...

Positive security model in ModSecurity

One of the major improvements in the next release of ModSecurity (v2.0) will be the support for a positive security model. Even now, with its flexible rule language, ModSecurity supports the positive security model. But there are areas that are...

ModSecurity for Apache 1.9 has been released!

Finally. I already wrote about many new features available in this release. Relieved from the pressure caused by a long delay between stable releases I can now go and add more features. (Goes away and looks at the TODO list.)...

A few more features made it into ModSecurity 1.9

A small number of new features made it into 1.9 at the very last minute. Initially I intended to only review code after 1.9dev3 but, as I my review went along, I realised there were certain features that are needed...

Apache 2.1.7 beta released

A new beta version of the Apache web server has been released. This release is important because it is a beta version in the 2.1.x development branch, meaning Apache is one step closer to an official 2.2 version. The most...

What's new in ModSecurity 1.9

You may have noticed it's been a while since ModSecurity has had a major release. This does not mean I was lazy. I was working on it throughout, but for various reasons beyond my control, I had to postpone the...

Major updates to ModSecurity in 1.9dev3

This version implements the final batch of major improvements to the 1.9.x series. These include a completely new audit logging subsystem intended for real-time audit log aggregation, audit logging based on response status code, support for PUT uploads, stateful denial...

Improvements to the Servlet specification

A while ago Greg Murray (the Servlet specification lead) asked for ideas for Servlet improvements. I generally like the Servlet specification, but it seems that it is easy to encounter its limitations if you are trying to do things others...

Web Security Improvement Ideas

I have been keeping a list of web security improvement ideas for some time now. It's a list that does not contain only my ideas but thoughts I picked up from others over the years. I have been showing the...

More on impedance mismatch

Recently there has been increased interest in the impedance mismatch problem, which occurs between multiple layers of a HTTP stack (e.g. proxy/security/web server) when they interpret HTTP differently. If you recall, I wrote about it in March. Shortly after Sverre...

The future of web application firewalls

It always pays off to visit Richard Bejtlich's blog once in a while. (Or, even better, subscribe to his RSS feed and get updated in real-time.) A short visit today uncovered a plethora of information relevant to web application security...

mod_security 1.8.7RC2 available

Second release candidate for mod_security 1.8.7 is available for download. I performed a detailed code review (of the new and affected code), fixed small bugs and tightened the code in few places. The fact there are two release candidates this...

ModSecurity for Java Milestone 3 now available

I have just released an updated version of ModSecurity for Java. This version implements the core functionality (request and response interception), and it contains a complete implementation of the portable web application firewall rule format. As I was uploading the...