Exploring and Improving the Usability of ModSecurity Web Application Firewall

Murat Alagoz, Mevlut Serkan Tok, Kemal Bicakci

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

1 Citation (Scopus)

Abstract

ModSecurity is an open-source web application firewall. The correct configuration is key to its effective operation but could be tricky since usability flaws could lead to errors and misconfiguration, threatening the security and availability. In this study, we first conduct the usability inspection of ModSecurity through a hybrid approach consisting of heuristic evaluation and cognitive walkthrough. We find out that ModSecurity has no feedback for semantic errors or successful rule implementation during the rule entry process, and the webserver goes down if there is a syntax error in any implemented rule. We propose a rule checking and feedback mechanism to mitigate these drawbacks. Then, we perform a between-subjects user study to evaluate the effectiveness and usability of our proposed method. The results indicate that unsuccessful rule entry rate and syntax error-related web server downtime significantly reduced with the rule checking and feedback mechanism introduced to ModSecurity. Thereby, we improve ModSecurity's effectiveness as well as the level of security and availability of ModSecurity-protected web servers.

Original languageEnglish
Title of host publication14th International Conference on Information Security and Cryptology, ISCTURKEY 2021 - Proceedings
EditorsSeref Sagiroglu, Sedat Akleylek, Mustafa Alkan, Ferruh Ozbudak, Yavuz Canbay, Ertugrul Karacuha, Ali Aydin Selcuk
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages51-56
Number of pages6
ISBN (Electronic)9781665407762
DOIs
Publication statusPublished - 2021
Event14th International Conference on Information Security and Cryptology, ISCTURKEY 2021 - Ankara, Turkey
Duration: 2 Dec 20213 Dec 2021

Publication series

Name14th International Conference on Information Security and Cryptology, ISCTURKEY 2021 - Proceedings

Conference

Conference14th International Conference on Information Security and Cryptology, ISCTURKEY 2021
Country/TerritoryTurkey
CityAnkara
Period2/12/213/12/21

Bibliographical note

Publisher Copyright:
© 2021 IEEE.

Keywords

  • command-line interface
  • human-computer interaction
  • ModSecurity
  • usability
  • Usable security
  • web application firewall

Fingerprint

Dive into the research topics of 'Exploring and Improving the Usability of ModSecurity Web Application Firewall'. Together they form a unique fingerprint.

Cite this