OWASP ModSecurity

OWASP HQ has approved the intermediate leadership team for OWASP ModSecurity. We say intermediate, because the plan is to bring the community together in the 2nd quarter of 2024 and create a new leadership team. This can be the same people or a new crew, but it’s going to be a team where the community has a say.

But during the setup phase of the new OWASP ModSecurity project, there is no time for long discussions, though. Better get moving fast.

So here is the team of three OWASP ModSecurity Co-Leads for the time being:

Ervin Hegedüs from Digitalwave in Hungary is a C/C++ developer and long standing contributor to OWASP CRS. He knows the ModSecurity2 and the libModSecurity3 code base and he contributed several pull requests to the project. He is also providing ModSecurity packages on https://modsecurity.digitalwave.hu/, a very popular service and he is official maintainer for ModSecurity and CRS on Debian and Ubuntu.

Digitalwave.hu is a small service provider in Hungary. They are planning to invest into ModSecurity given the new situation of the project. Expect more news in coming weeks.

For the near future, Ervin will primarily focus on coordinating the libModSecurity3 development and the development of the related connectors.

Marc Stern from Approach-Cyber in Belgium is a long term ModSecurity contributor with literally dozens of open pull requests on GitHub. Interestingly, he is not active in the CRS community, so he contributes with a perspective of somebody using a custom rule set that is embedded in a complex management framework complementing the CRS capabilities. We think this non-CRS perspective is an important counter weight.

Approach-Cyber is a mid-sized security service provider from Belgium with offices in Belgium and - lately - Switzerland. Approach-Cyber has a very strong ModSecurity offering and custom extension development starting as early as 2003. They apparently see ModSecurity as strategic for their offering with the board backing Marc’s investment into the code base.

Approach plans to contribute code that improves the software in the following areas:

• Stability

• Consistency

• Performance

• Orthogonality

• Genericity

So clearly for a quality improvement of the code base.

For the near future, Marc will primarily focus on coordinating the ModSecurity2 development.

Christian Folini from netnea.com in Switzerland is a long term ModSecurity user and OWASP CRS co-leader with a lot of experience with community building and project governance. He contributed very little to the ModSecurity code base, but he wrote the 2nd edition of the quasi official ModSecurity Handbook with original author Ivan Ristić. Christian is a well known teacher on the subject and a long standing figure in the ModSecurity / CRS community as well as the OWASP community, that he joined 15+ years ago.

Netnea.com is a small Swiss consulting company focusing on network monitoring and application security.

For the near future, Christian will primarily focus on project coordination, communication, documentation and administration. Christian plans to give up his leadership position at said community meeting Spring 2024.

As you can see, we bring a lot of experience and credibility to the table. We know what we are doing and we welcome this frest start for ModSecurity with open arms.

We tried to balance CRS with non-CRS interests and we tried to bring in a non-OWASP person (-> Marc) into the team as well. We are all working for small and mid-sized companies, definitely not big tech or startups with a need for fast money. So we do this, because it’s the right thing to do.

Let’s get going!

Ervin, Marc and Christian