Here's another thing from the past. I think WAFEC v2 should be built on top of WAFEC v1 as well as the work of the OWASP Germany chapter. They did a lot of interesting work in the areas where WAFEC was/is weak. http://www.owasp.org/index.php/Category:OWASP_Best_Practices:_Use_of_Web_Application_Firewalls -- Ivan Ristić