This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit

Difference between revisions of "WASC OWASP Web Application Firewall Evaluation Criteria Project"

Jump to: navigation, search
(As of September 2015 the objectives are)
Line 19: Line 19:
===As of July 2015 the objectives are===
===As of September 2015 the objectives are===
==Summer 2015==
==Summer 2015==

Revision as of 00:10, 23 September 2015

OWASP Project Header.jpg

This will serve as the main project page going forward, but for historical links please refer to here

Web application firewalls (WAF) are an evolving information security technology designed to protect web sites from attack. WAF solutions are capable of preventing attacks that network firewalls and intrusion detection systems can't, and they do not require modification of application source code.

As today's web application attacks expand and their relative level of sophistication increases, it is vitally important to develop a standardized criteria for WAFs evaluation. The Web Application Firewall Evaluation Criteria Project (WAFEC) serves two goals:

  • Help stakeholders understand what a WAF is and its role in protecting web sites.
  • Provide a tool for users to make an educated decision when selecting a WAF.

WAFEC is a joined project between The Web Application Security Consortium (WASC) and OWASP making sure the best minds in the industry, both those who work day and night to develop WAFs and those who implement and use them, are committed to ensure WAFEC is comprehensive, accurate and objective.

The first version of WAFEC was released in 2006 and is in wide use in the industry. In 2013, the project team was gearing up to release version 2. Due to a number of issues with WAFEC as outlined in the 2013 OWASP AppSecEU presentation WASC/OWASP WAFEC this project was sidelined until earlier this year when it transitioned from Ofer Shezaf to Tony Turner. We are now working on rebooting the WAFEC project and plan to release it in the second half of 2016. If you want to be a part of the project check out the Volunteering page or join the the mailing list and chime in when you feel ready.

If you have any other question or idea, please contact WAFEC project leader Tony Turner.

As of September 2015 the objectives are

Summer 2015

  • Re-establish project team - In progress and looking for volunteers
  • Migrate existing v2.0 doc to Google Docs - 90% completed, still incorporating disparate versions and prior comments
  • Address outstanding comments and make existing sections relevant for 2015 - Barely started

Fall 2015

  • Conduct workshop at AppSecUSA 2015
  • Create new document outline
  • Begin document re-work

Winter 2015

  • Create framework for evaluating controls
  • Logo and design work
  • Marketing strategy

Spring 2016

  • Complete 1st draft
  • Internal Testing
  • Conference presentation

Sumer 2016

  • Pre-release/Beta
  • Socialize the project and upcoming release

Fall 2016

  • Release WAFEC v3.0
  • Post-release support

Winter 2016

  • Revisit associated tools like Response Matrix

Current Needs include

  • Web App Pentesters experienced with WAF Bypasses
  • WAF Implementers
  • WAF Developers
  • WAF Vendor Liaisons
  • Metrics and standardization professional
  • Copy edit ninjas
  • Graphics designer

If you are interested, please contact WAFEC project leader Tony Turner.

What does this OWASP project offer you?
What releases are available for this project?
what is this project?
Name: WASC OWASP Web Application Firewall Evaluation Criteria Project (home page)
Purpose: WAFEC is a joined industry effort to define what Web Application Firewalls are and provide the application security community with a tool to learn about WAFs and evaluate the suitability of different WAFs for their needs.
License: Creative Commons Attribution License 2.5
who is working on this project?
Project Leader(s):
how can you learn more?
Project Pamphlet: Not Yet Created
Project Presentation:
Mailing list: Mailing List Archives
Project Roadmap: [Roadmap View]
Main links:
Key Contacts
current release
Version 1.0 of WAFEC was released in 2006 and is heavily used in the industry featuring in an estimated 50% of WAF RFPs. WAFEC 1.0 is available for download in the following formats:
last reviewed release
Not Yet Reviewed

other releases