This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
WASC OWASP Web Application Firewall Evaluation Criteria Project
NoteThis will serve as the main project page going forward, but for historical links please refer to here BackgroundWeb application firewalls (WAF) are an evolving information security technology designed to protect web sites from attack. WAF solutions are capable of preventing attacks that network firewalls and intrusion detection systems can't, and they do not require modification of application source code. As today's web application attacks expand and their relative level of sophistication increases, it is vitally important to develop a standardized criteria for WAFs evaluation. The Web Application Firewall Evaluation Criteria Project (WAFEC) serves two goals:
Project StructureWAFEC is a joined project between The Web Application Security Consortium (WASC) and OWASP making sure the best minds in the industry, both those who work day and night to develop WAFs and those who implement and use them, are committed to ensure WAFEC is comprehensive, accurate and objective. HistoryThe first version of WAFEC was released in 2006 and is in wide use in the industry. In 2013, the project team was gearing up to release version 2. Due to a number of issues with WAFEC as outlined in the 2013 OWASP AppSecEU presentation WASC/OWASP WAFEC this project was sidelined until earlier this year when it transitioned from Ofer Shezaf to Tony Turner. We are now working on rebooting the WAFEC project and plan to release it in the second half of 2016. If you want to be a part of the project check out the Volunteering page or join the the mailing list and chime in when you feel ready. More informationIf you have any other question or idea, please contact WAFEC project leader Tony Turner. |
==Presentation==
AppsecEU 2013 Project Leader
Contributors
Vendor Sub-group
News and Events
Mailing List
1. Is WAFEC unfairly biased in favor of vendors who participate? ANSWER: All contributions sourced by the vendor sub-group or provided by the active employee for any WAF vendor are peer-reviewed by all other participating vendors before the update can be committed. Vendors who want to have input in the direction of the WAFEC standard should see the Volunteering link and get involved. 2. Is WAFEC a dead project? ANSWER: Most certainly not! WAFEC has been rebooted as of June 2015 under the leadership of Tony Turner and a project workshop is being held at the AppSecUSA conference in San Francisco to renew efforts at the next version. See the Roadmap for more information 3. Does WAFEC certify WAF vendors? ANSWER: WAFEC does not currently provide certification but instead intends to provide tools for others to perform their own independent evaluation for WAF vendors. It is important that any evaluation take into consideration the unique requirements and documented use cases for the WAF as not all deployments will have the same requirements. 4. Does WAFEC recommend $vendorX? ANSWER: WAFEC remains impartial and does not recommend or discourage any vendor over another. There are often scenarios where a less capable product may be a smarter choice than a best of breed solution, or a niche product may be very well-suited for a particular use case. The WAFEC team works with multiple vendors and does not show bias in any way. Any vendor is welcome to participate in standards development and contributions will be made public consistent with OWASP transparency expectations.
As of September 2015 the objectives areSummer 2015
Fall 2015
Winter 2015
Spring 2016
Sumer 2016
Fall 2016
Winter 2016
Core Team
Vendor Sub-group
If you are a prior contributor and want to participate in renewed efforts at WAFEC 2.0 and beyond please contact Tony Turner. Current Needs include
If you are interested, please contact WAFEC project leader Tony Turner.
|
|||||||||||||||||||||||||||||||||||||||||||
