[Autogenerated] Welcome to the application analysis with mod security course.
My name is Michael Eddy.
And in this course you will learn how mod security can help your
organization mitigate attacks against your web applications mod
security was initially created and developed in 2002 by Ivan Ristic as
a single module for the Apache web server.
Since then,
mod security has had significant design changes and is currently
developed and maintained by Trustwave Spider Labs.
Version three of mod Security is a complete rewrite into two components.
The core lib mod security library and connectors for
Apache and engine X web servers.
I'll talk more about this later.
So what exactly is mod security?
Well,
it's an open source web application firewall that sits in
front of your web applications and can monitor and block
http traffic to your web apps.
Spider Labs has a GIT repository where you can download my security if you
want to start leveraging its ability to harden your web applications and
potentially support compliance requirements.
The Nist cybersecurity framework provides organizations of any
size with a common language that can be used to communicate risk
management strategies using domain based guidance industry
standards and best practices.
The core functions of the Nist CSF are identify protect,
detect, respond and recover.
Each function has several categories and subcategories that map to
other well known frameworks such as Covid and the C I.
S critical security controls mod security can be configured to
detect attacks and take some action or if you choose,
it can be configured in a detection only mode This place is my
security into the protect and detect functions.
However, for this short course we will only focus on the protect function,
which has two relevant categories.
Protective technology is the first followed by identity management,
authentication and access control.
When we drill down even further, three subcategories apply to mod security.
Pr dot p T four communications and control networks are protected pr dot a c
dash three remote access is managed pr dot a c dash five.
Network integrity is protected.
Keep in mind that this isn't a comprehensive list for my security
but represents the focus areas of this course.
Let's look at another framework.
I'm a huge fan of the miter attack framework.
The rest of this course will provide demos of two minor attack
techniques that mod security can help mitigate against.
The first technique is T 1190 exploit public facing application.
Then we have T 11 10.4.
Credential stuffing a brute force sub technique.
I will elaborate more on these during the demos.
Let us look at a sample diagram of a mod security
deployment in an enterprise environment.
There are two officially supported deployment configurations.
The first is an embedded deployment using connectors for a supported web server.
The other deployment configuration is a reverse proxy.
This diagram depicts mod security as a reverse proxy protecting a web server
farm which has the benefit that the web service can be from any vendor and
run on any platform mod security will inspect inbound global http traffic and
even outbound Web server responses.
Using the configured detection rules, no matter which setup you choose,
mod security is well suited to protect your Web
infrastructure from a broad range of attacks.
The demos in the following clips, will utilize the reverse proxy deployment.