#RomHack2021 - Folini - Proteggere l'accesso al voto online con l'OWASP ModSecurity Core Rule Set

Speaker

Christian Folini, 15-year ModSecurity production veteran and OWASP CRS co-lead, presents a defensive blue-team case for protecting high-assurance systems—notably Swiss internet voting—with ModSecurity plus the Core Rule Set.

WAF reality

Commercial WAF markets exploded after PCI DSS mandated presence (not effective configuration); Folini compares WAFs to seat belts—baseline protection buying time, not a silver bullet replacing secure code and patching.

Stack

ModSecurity is an Apache/nginx module applying byte-level inspection and regex rules; CRS is the dominant open ruleset, reused by many commercial products, blocking roughly 80%+ of Burp-driven exploits in benchmark tests while skilled attackers may still persist.

Voting use case

For online voting's high-security needs, CRS on ModSecurity is positioned as the practical open-source path versus expensive commercial offerings that often wrap the same engine without added value.