Usability analysis of an open source web application firewall ModSecurity

Attacks try to exploit network and system vulnerabilities, increased the demand for products such as firewalls and intrusion detection systems. With the development of security products and the better management of cyber security teams, it is observed that the increase in information security violations has evolved and shifted towards the application layer. Well-designed security products are more preferred by system administrators and play an active role in providing security. However, when the usability principles are ignored in the development of the products, the users cannot obtain the benefit they expect from the products, they can even configure the products incorrectly and make the system to be defended more vulnerable. The firewall is still considered a must-have security device. He has gained various talents since his first release. While web applications, which are at the focal point of attacks, constitute a significant part of the attack surface, only firewalls or intrusion detection systems are insufficient to protect web applications. Before the clients reach the server, the traffic is terminated on a security device and only the specified requests are requested to reach the server, thus the need for the web application firewall arises. A web application firewall is a type of firewall that secures web applications and works down to the application layer. It is deployed between the application and the client and can analyze two-way traffic. ModSecurity is an open source web application firewall. With the Core Rule Set (CRS) of the Open Web Application Security Project (OWASP), which aims to provide a basic level of protection for all web applications, ModSecurity performs security checks according to the given rule sets. Although it is possible to provide solutions by detecting issues that negatively affect usability through usability studies, it is possible to reduce the wrong configurations, which are one of the most common web application weaknesses. In this study, the usability control and operation of ModSecurity with the hybrid method was carried out. In the first stage, ModSecuirty was evaluated using heuristic evaluation and cognitive review techniques, and a script was created by designing a rule-control and feedback mechanism that will provide improvement in three different subjects in the light of the findings. In the second stage, in order to measure the contribution of the script to usability, first an experiment environment was prepared in cloud systems, and remote user work was carried out with computer engineering students, who are the system administrators of the future, taking into account the pandemic conditions. As a result; It has been determined that the designed mechanism contributes positively to the correct configuration of the web application firewall ModSecurity and reduces the downtime of the web server due to syntax errors made by system administrators while entering the rule.