Appendix C: URLScan and ModSecurity

Overview

This appendix presents overviews of how to install and configure URLScan and ModSecurity, web server firewalls for IIS and Apache, respectively. URLScan is produced by Microsoft and is available for free. ModSecurity is produced by Ivan Ristic of Thinking Stone, and is available under both GPL and commercial licenses. Both may be obtained easily from the links provided at the end of this appendix.

The material here is adapted from publicly available documentation (again listed at the end of this chapter), as well as our own experiences working with the tools individually and as consultants to large organizations. As with any technology, it is important to understand the advantages and drawbacks of using URLScan and ModSecurity, but on the whole, we feel they provide strong defense to IIS and Apache web applications if used properly. In fact, when Apache is configured to work as a reverse proxy and combined with ModSecurity, the result is a general-purpose network-based web application firewall that can be used to protect any number of web servers.

Even if you decide not to implement URLScan or ModSecurity, we hope the discussion of the protection mechanisms they offer is educational in terms of general web server security.