Web applications allow companies to use the power of the Internet to conduct business and interface with a larger market, delivering a better user experience for their customers and partners. With this growth in usage, attackers are targeting Web applications to break into the core of an organization and gain access to its privileged information.
ModSecurity is a free, open source Web application firewall (WAF) that is continuously developed and managed by SpiderLabs, Trustwave's advanced security team. This open source technology enforces security policies to Web transactions, reducing the risk of Web-based attacks. As an open source technology, users and developers contribute to the community to help maintain a sustainable solution that defends Web applications.
"Having ModSecurity available for these additional platforms will help organizations protect their Web applications from attacks," said Nicholas J. Percoco, senior vice president and head of Trustwave SpiderLabs. "As the principal custodian of the ModSecurity open source product, we believe this new support for Microsoft IIS and Nginx will further expand the popularity of the industry’s open-source Web application firewall.”
Trustwave’s participation in the Microsoft Active Protections Program (MAPP), a program for security software providers, gives Trustwave early insight into “Patch Tuesday” vulnerabilities. Trustwave SpiderLabs uses this insight to develop protections for Trustwave products, including Trustwave’s managed security services and its Web application firewalls, WebDefend and ModSecurity.
"It is critical for organizations to address identified Web application vulnerabilities as soon as possible," added Percoco. "ModSecurity is an excellent tool for addressing the vulnerability before the Web application can be updated. Our update for ModSecurity is another testament to Trustwave’s commitment to helping organizations secure their applications and data.”
ModSecurity is a viable option for organizations such as hosting providers that have multiple customers using Web applications or companies that want a deeply customized Web application firewall to protect their Web application environment.
Trustwave also offers a proprietary Web application firewall called Trustwave WebDefend, which gives organizations a simplified and easy-to-install Web application firewall that offers out-of-the-box reporting, a graphical user interface, and secured integration with Trustwave SIEM. Trustwave WebDefend can be purchased as a stand-alone product, or as a component of the Trustwave 360 Application Security program, which combines secure code training, application penetration testing and code review with the Trustwave WebDefend Web application firewall.
Supporting this announcement, Greg Wroblewski of Microsoft’s Security Response Center and Ryan Barnett of Trustwave SpiderLabs will present: “ModSecurity as a Universal Cross-Platform Web Protection Tool,” and give live demonstrations as part of Arsenal Tools at the Black Hat USA 2012 security conference in Las Vegas, today, July 25.
The latest version of ModSecurity is currently available at http://www.modsecurity.org/download/.