Breach SecurityBreach Security is committed to contributing to the development of the ModSecurity open source community and this is evidenced by new releases of ModSecurity, the Core Rules, as well as, offering an Enhanced Rule set and commercial support packages. Breach Security has also incorporated ModSecurity technology into its suite of web application security solutions - the ModSecurity Pro appliance and the ModSecurity Management Appliance (MMA). Since the acquisition, Breach Security has provided the following products and offerings based on ModSecurity technology:
There have been many positive changes resulting from the acquisition. Development has accelerated as Breach has hired a full time developer who is assigned to working on the code full time, and that's in addition to having Ivan spend more time and energy on development. The documentation and community support has been improved too, as Breach hired a ModSecurity Community Manager who is dedicated full-time to growing and nurturing the community. The latter is very significant as the interaction with the community is the main opportunity for further expansion. Web application security is complicated due to the dynamic environment and the web application firewalls protecting those applications must manage a changing environment. ModSecurity can be difficult to use for some because there are no wizards and no implicit protection facilities. Users must have a high level of expertise. While this works well for the professionals, ModSecurity should be an equally suitable solution for people who are not web application security gurus but have an equally important need to protect themselves, while minimising their time investment in the process. Many ModSecurity users have also benefited from the commercial offerings. They have the option to purchase a commercially supported version of ModSecurity from an organisation with broad reach. That, and the range of appliances that have been released, have ensured that users have a very wide choice of deployment options. Our current appliance is *very* affordable. Breach Security wants to continue to pursue the main goal of the ModSecurity project, and that is to make web application firewalls accessible to everyone. Based on the world’s most deployed web application firewall with over 15,000 users, the ModSecurity Pro appliance offers essential web application security at an affordable price. It includes the mature, proven ModSecurity web application firewall on a hardened, Linux-based security appliance. The appliance not only defeats a wide range of application-layer attacks, but also helps ensure compliance with government and industry standards and regulations, and provides real-time event analysis. The appliance can be deployed transparently in front of multiple web servers to insulate web applications from the vulnerabilities inherent in web server technologies. In this deployment mode, the appliance monitors application traffic, performs a wide set of checks for web application attacks, and reacts in real time. The appliance can be easily deployed inline in a transparent bridge mode, which has many benefits including:
The ModSecurity Pro’s pre-packaged rule sets prevent information leakage and help organizations with their compliance efforts. These easy-to-apply rule sets save time and provide immediate protection for production applications against targeted attacks. Individual rule sets can be applied on a per-web application basis for more customized protection. Included rule sets address:
The web-based ModSecurity management interface provides easy-to-use, anytime, and anywhere access to alerting, event analysis, and reporting capabilities. The ModSecurity management interface offers administrators a complete picture of their web applications’ operations and security by giving them in-depth event analysis. Detailed and summary reports for security, compliance, and audit requirements are available.
Organizations with multiple ModSecurity open-source and ModSecurity Pro commercial deployments invest a significant amount of IT resources to secure and monitor their web applications. Often, each sensor must be individually monitored to determine if an attack has occurred. As a result, vital IT resources are consumed and application vulnerabilities still may not be identified in a timely manner, potentially leaving the organization and its sensitive data exposed. The ModSecurity Management Appliance addresses the ModSecurity community’s needs by allowing its members to remotely manage events from their distributed sensor deployments. Used in conjunction with ModSecurity and the commercial appliance deployments, the appliance collects, aggregates, and displays alert information from up to 50 open-source and commercial sensors to provide real-time, detailed visibility into each web application. The ModSecurity Management Appliance supports multiple remote sensors. The appliance is built upon a reliable, high-performance framework that can securely collect log and alert data for events from up to 50 open-source and commercial sensors in real time. This support provides administrators with a single source for web application security information so they can remediate issues immediately. On-screen, detailed event views allow organizations to identify specific application vulnerabilities. The ModSecurity Management Appliance categorizes each alert based on type, provides insight into the sensor receiving it, identifies the source address trigger, and displays the type of attack. Administrators can re-categorize events into custom categories to help document and report on the organization’s compliance with government and industry standards and regulations. The ModSecurity Management Appliance’s reporting capabilities help organizations meet their security, compliance, and audit requirements. Included reports detail events by type, date and time, or per sensor. All reports are formatted and available as PDF files. Reports can be scheduled, produced on-demand, and/or distributed via email to ensure that information is available when and where it is needed.
The Enhanced Rule Set is the commercially supported version of ModSecurity rules offered as either part of the commercial Support contract or supplied as part of the ModSecurity Pro appliance. The Enhanced Rule Set includes all of the same rules available in the open source Core Rule set however it includes other rules to help address specific issues. There are optional rulesets that will cause ModSecurity to skip most of the inspection when a static request is made. This is desired since attack vectors are mainly only available in dynamic content where the web application takes argument input from clients. Exclusion of these requests greatly increases the performance of ModSecurity. The Enhanced Rule Set provides specific protection for an array of Web Servers and development environments including IIS, Apache, ASP, ASP.NET, PHP and FrontPage. For each such environment the following security features are provided:
In addition to protecting web applications from attacks, The Enhanced Rule Set has a number of features specifically designed for organizations working to comply with the PCI standard. These features ensure the proper configuration of the security mechanisms for PCI compliance as well as reporting that provide specific PCI standard details for each attack prevented.
For each event reported, The Enhanced Rule Set adds a tag describing which OWASP top ten category and which Web Application Security Consortium Threat Classification the event relates to. The Enhanced Rule Set offers specific protection for OWA web servers. This protection includes:
Breach Security’s Customer Care program provides world-class security wherever and whenever you need it. Our team has made a commitment of excellence to ensure your satisfaction with every aspect of our products. Utilizing the latest technical resources and many combined years of experience, our security support team promptly answers questions and resolves issues. The services organization is ready with packaged training programs, quick start implementation services and certification programs that enable an organization to maximize its resources with the confidence that ModSecurity is protecting their web applications from the first day of implementation. ModSecurity Commercial Support includes:
This one-day class is for those people who want to learn how to build and deploy a ModSecurity Web Application Firewall. We will also cover the open source ModSecurity Console, which helps manage alerts on suspicious web activity targeting your web servers. Hands-on labs with fully documented instructions help students deploy solid, secure ModSecurity installations and understand the inner workings of the premier open source web application firewall available today.
This course assumes that students have a technical understanding of the HTTP protocol and a general understanding of client/server communications and network architecture. Proficiency with Linux and UNIX text editing tools (vi editor) is suggested, not required.
This one-day class provides an in-depth look at ModSecurity rules and ModSecurity rules language syntax. ModSecurity is currently the most widely used open source web application firewall product. Learning how to take advantage of the power behind ModSecurity rules can help web security administrators write and configure highly effective rules. This class features extensive hands-on rules development and testing to reinforce the theoretical concepts that are presented.
In order to gain the most value from the course, students should be familiar with Perl Compatible Regular Expressions (PCRE). This course assumes that students have a technical understanding of the HTTP protocol. Proficiency with Linux and UNIX text editing tools (vi editor) is suggested, not required.
|
|
