Yesterday, I wrote a blog post about the first day of the Usenix Enigma conference. Here is my take on the second day. Dhia Mahjoub from OpenDNS kicked off the day with his insights into the detection of bulletproof and anonymous hosting providers. As expected, Dhia did not speak about the traditional bullet proof hoster […]
After the big success of the first Usenix Enigma conference in 2016 I set my mind on participating in 2017. Conveniently, I run the program committee of the Swiss Cyberstorm Conference (October 18, 2017) which gives me a good excuse to take a week off and to fly to California. I landed during the #NoMuslimBan […]
@avarx_ is part of the Swiss team for the European Cyber Security Challenges and also a member of the TYPO3 security team. I joined with him to start a set of TYPO3 rule exclusions for the OWASP ModSecurity Core Rule Set 3.0 (short CRS3). This is a set of rules to be deployed on a WAF in order to […]
What I like about Ivan Ristić’s ModSecurity Book is the wide approach it takes. The multipurpose nature of ModSecurity makes it hard to overview all the areas and all the functionality. But Ivan did a very good job providing a gentle introduction to all these areas. Hence, it proved to be the standard book for […]
The new Core Rule Set 3.0 (CRS3) release simplifies ModSecurity/Drupal integration tremendously. Here is a guide aimed at the Drupal community to learn how to work with ModSecurity. This guide and the rule file it is based on currently covers Drupal Core. Modules / Plugins are not yet supported. But count on the Drupal community […]
