Willing to know more about Cloudflare Modsecurity features? We can help you.

At Bobcares, we offer solutions for every query, big and small, as a part of our Server Management Service.

Let’s take a look at how our Support Team assist with this query.

Cloudflare Modsecurity

Today, let us see Modsecurity/WAF layered defenses listed by our Support Techs

• Firstly, cloudflare managed rules offer advanced zero-day vulnerability protections.
• Secondly, core OWASP rules block familiar “Top 10” attack techniques.
• Then, custom rulesets deliver tailored protections to block any threat.
• WAF ML complements WAF rulesets by detecting bypasses and attack variations of XSS and SQLi attacks.
• Then, exposed credential checks monitor and block use of stolen/exposed credentials for account takeover.
• Sensitive data detection alerts on responses containing sensitive data.
• Then, advanced rate limiting prevents abuse, DDoS, brute force attempts along with API-centric controls.
• Flexible response options allow for blocking, logging, rate limiting or challenging.

Key features and benefits :

Compatibility with ModSecurity logic and format :  It allows you to easily import existing rule sets to maintain existing protection

Core OWASP ModSecurity rule sets :  Protects against OWASP vulnerabilities, the most critical flaws as identify by The Open Web Application Security Project.

Block :  Blocking an attack will stop any action before it is post to your website.

Simulate :  To test for false positives, set the WAF to Simulate mode, which will record the response to possible attacks without challenging or blocking.

Challenge :  A challenge page asks visitors to submit a CAPTCHA to continue to your website.

Threshold / sensitivity setting : Set rules to trigger more or less depending on sensitivity

Customizable block pages : Customize the page a visitor sees when they’re blocked.

Understanding WAF managed rules

WAF manage rules monitor web requests to your domain and filters out undesired traffic based on rulesets that you enable.

Managed rules, a feature of Cloudflare WAF (Web Application Firewall), identifies and removes suspicious activity for HTTP GET and POST requests.

Managed rules are available to Pro, Business, and Enterprise plans for any subdomains proxy to Cloudflare.

Control manage rules settings in Security > WAF > Managed rules.

Managed rules includes three packages:

• Firstly, cloudflare Managed Ruleset
• Secondly, package: OWASP ModSecurity Core Rule Set
• Thirdly, customer Requested Rules

Cloudflare Managed Ruleset

The Cloudflare Managed Ruleset contains security rules written and curated by Cloudflare.

Then, click on a ruleset name under Group to reveal the rule descriptions.

Cloudflare Specials is a Group thatprovides core firewall security against common attacks.

Cloudflare recommends that you always leave Cloudflare Specials enabled.

When viewing a ruleset, Cloudflare shows default actions for each rule listed under Default mode.

The Mode available for individual rules within a specific Cloudflare Managed Ruleset are:

• Default – takes the default action listed under Default mode when viewing a specific rule.
• Disable – turns off the specific rule within the group.
• Block – the request is discarded.
• Legacy CAPTCHA – the visitor receives a CAPTCHA challenge page.
• Simulate – the request is allowed through but is logged in the Activity log.

Cloudflare’s WAF changelog allows customers to monitor ongoing changes to the Cloudflare Managed Ruleset.

Package: OWASP ModSecurity Core Rule Set

Package: OWASP ModSecurity Core Rule Set assigns a score to each request based on how many OWASP rules trigger.

Some OWASP rules have a higher sensitivity score than others.

After OWASP evaluates a request, Cloudflare compares the final score to the Sensitivity configured for the domain.

If the score exceeds the Sensitivity, the request is actioned based on the Action configured within Package: OWASP ModSecurity Core

Control Cloudflare’s OWASP package

Package: OWASP ModSecurity Core Rule Set contains several rules from the OWASP project.

Cloudflare does not write or curate OWASP rules.  Click on a ruleset name under Group to reveal the rule descriptions.

Unlike the Cloudflare Managed Ruleset, specific OWASP rules are either turned On or Off.

To manage OWASP thresholds, set the Sensitivity to Low, Medium, or High under Package: OWASP ModSecurity Core Rule Set.

Setting the Sensitivity to Off will disable the entire OWASP package including all its rules.

Determining the appropriate Sensitivity depends on your business industry and operations. For instance, a Low setting is appropriate for:

• Firstly, certain business industries more likely to trigger the WAF.
• Then, large file uploads.

[Looking for a solution to another query? We are just a click away.]

Conclusion

To sum up, our skilled Support Engineers at Bobcares demonstrated about Cloudflare Modsecurity features.