WAF In DevOps DevOpsFusion2019
- 2. Web Application Firewall in DevOps
- 4. whoami ● franziska bühler ● architect @ puzzle ITC ● OWASP ModSecurity Core Rule Set (WAF Rules) ● OWASP DevSlop
- 5. Outline 1. Web Application Firewall 2. ModSecurity and Core Rule Set 3. WAF a Part of DevOps
- 6. Outline 2. ModSecurity and Core Rule Set 3. WAF a Part of DevOps 1. Web Application Firewall
- 7. 1st line of defense APPWAF SQLi Attack XSS Attack
- 9. Too late !
- 10. « We need a better process to get WAFs into production. » - Franziska Bühler
- 11. Test WAF
- 12. Outline 1. Web Application Firewall 2. ModSecurity and Core Rule Set 3. WAF a Part of DevOps
- 16. Request Rules
- 17. Malicous Request
- 18. Response Rules
- 19. Response : SQL Stack Trace
- 20. False Positive
- 22. Outline 1. Web Application Firewall 2. ModSecurity and Core Rule Set 3. WAF a Part of DevOps
- 24. ModSecDevOps
- 25. Setup
- 26. Setup WAF
- 28. Fast Feedback
- 29. CRS Container $> docker pull franbuehler/modsecurity-crs-rp $> docker run -dt -e BACKEND=http://172.17.0.1:8000 franbuehler/modsecurity-crs-rp
- 30. WAF at
- 32. WAF makes everyone happy!
- 34. Let’s make the world of web applications more secure - Let’s add a WAF !