[WASC-WAFEC] IronBee -- a new Apache-licensed web application firewall

Ivan Ristic ivan.ristic at gmail.com
Wed Feb 23 10:02:42 EST 2011

2011/2/23 Ryan Barnett <rcbarnett at gmail.com>:
> On 2/23/11 4:23 AM, "Ivan Ristic" <ivan.ristic at gmail.com> wrote:
>>On Wed, Feb 23, 2011 at 5:50 AM, Christian Heinrich
>><christian.heinrich at cmlh.id.au> wrote:
>>> Ivan,
>>> On Tue, Feb 22, 2011 at 10:39 PM, Ivan Ristic <ivan.ristic at gmail.com>
>>>> I am writing to this list because I expect there will be an overlap
>>>> between WAFEC and the documentation effort at IronBee. In the next
>>>> week or so we will start a new section on our wiki to enumerate all
>>>> the relevant attacks against web applications and then document what
>>>> web application firewalls can do to address them (with a view to
>>>> implement those defences in IronBee).
>>>> We should perhaps include a copy of the wiki content in WAFEC itself.
>>>> After all, one of our goals would be helping end users to understand
>>>> what WAFs can and cannot do.
>>> Can I recommend that this be extended to ModSecurity (possibly
>>> completed by Ryan) so that a common benchmark can be established with
>>> the intent of this body of work possibly being reused by other WAF
>>> vendors?
>>That's absolutely fine. Our only requirement is that any stuff that
>>gets put into IronBee is licensed under Apache Software License v2.
>>Yesterday I actually started writing one of the pages to establish a
> May I suggest that we create this wiki content on the wasc projects site?

Sure -- provided the (WAFEC) team considers such content to be within
the scope of our work here.

Did I mention that the Best Practice: WAFs document already contains a
table that can be used as a starting point for this activity?

Ivan Ristić

More information about the wasc-wafec mailing list