cis-apache-6-7

name	cis-apache-6.7
description	Ensure the OWASP ModSecurity Core Rule Set Is Installed and Enabled
category	cis-apache
version	3.6.0
author	cyberstrike-official
tags	["cis","apache","linux","modsecurity","waf","owasp","logging","monitoring"]
cis_id	6.7
cis_benchmark	CIS Apache HTTP Server 2.2 Benchmark v3.6.0
tech_stack	["linux","apache"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure the OWASP ModSecurity Core Rule Set Is Installed and Enabled

Description

The OWASP ModSecurity Core Rule Set (CRS) is a set of open source web application defensive rules for the ModSecurity web application firewall (WAF). The OWASP ModSecurity CRS provides baseline protections in the following attack/threat categories:

• HTTP Protection - detecting violations of the HTTP protocol and a locally defined usage policy.
• Real-time Blacklist Lookups - utilizes 3rd Party IP Reputation
• HTTP Denial of Service Protections - defense against HTTP Flooding and Slow HTTP DoS Attacks.
• Common Web Attacks Protection - detecting common web application security attack.
• Automation Detection - Detecting bots, crawlers, scanners and other surface malicious activity.
• Integration with AV Scanning for File Uploads - detects malicious files uploaded through the web application.
• Tracking Sensitive Data - Tracks Credit Card usage and blocks leakages.
• Trojan Protection - Detecting access to Trojans horses.
• Identification of Application Defects - alerts on application misconfigurations.
• Error Detection and Hiding - Disguising error messages sent by the server.

Note: Like other application security/application firewall systems, Mod_Security requires a significant commitment of staff resources for initial tuning of the rules and handling alerts. In some cases, this may require additional time working with application developers/maintainers to modify applications based on analysis of the results of tuning and monitoring logs. After setup, an ongoing commitment of staff is required for monitoring logs and ongoing tuning, especially after upgrades/patches. Without this commitment to tuning and monitoring, installing Mod_Security may NOT be effective and may provide a false sense of security.

Rationale

Installing, configuring, and enabling the OWASP ModSecurity Core Rule Set (CRS) provides additional baseline security defense and a good starting point to customize the monitoring and blocking of common web application attacks.

Impact

None documented

Audit Procedure

For the OWASP ModSecurity CRS version 2.2.9, perform the following to audit the configuration:

In the 2.2.9 release, the OWASP ModSecurity CRS contains 15 base_rule configuration files, each with rule sets. The CRS also contains 14 optional rule sets, and 17 experimental rule sets. Since it is expected that customization and testing will be necessary to implement the CRS, it is not expected that any site will implement all CRS configuration files / rule sets. Therefore, for the purpose of auditing, the OWASP ModSecurity CRS will be considered implemented if 200 or more of the security rules (SecRule) are active in the CRS configuration files. The default 2.2.9 installation contains 227 security rules. Perform the following to determine if 2.2.9 OWASP ModSecurity CRS is enabled: