8000 Reference and Tag with CAPEC IDs consistently · Issue #486 · coreruleset/coreruleset · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Reference and Tag with CAPEC IDs consistently #486

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
CRS-migration-bot opened this issue May 13, 2020 · 7 comments
Closed

Reference and Tag with CAPEC IDs consistently #486

CRS-migration-bot opened this issue May 13, 2020 · 7 comments
Labels
⏲️ In progress

Comments

@CRS-migration-bot
Copy link

Issue originally created by user dune73 on date 2016-08-05 08:57:59.
Link to original issue: SpiderLabs/owasp-modsecurity-crs#486.

CAPEC: Common Attack Pattern Enumeration and Classification (https://capec.mitre.org/)

We have a few rules with CAPEC tags and links to CAPEC descriptions in their comments. But so far this, has not been done in a consistent way. A systematic approach is necessary. It would also be the base for consistent attack statistics.

Part of the task is a discussion if we want to abandon the incomplete OWASP tags - or not.
@CRS-migration-bot
Copy link
Author

User dune73 commented on date 2017-11-25 21:27:25:

This topics has been discussed in #924 and in a chat as well.

Copying over the summary of the discussion:

We talked about this for a great length during the chat. Here are the important bits:

  • The tagging used in CRS is not systematic. We would like to streamline it.
  • Tags eat up space in the alert message and can be cut when the alert message is made to fit the Apache error.log line length. The less tags, the better. Everybody agreed on this.
  • Many rules use WASC taxonomy, but that's probably dead.
  • CVE might be fun, but the way the users and the project works and how CVEs hit the news, we'll always be late.
  • CAPEC are an alternative to CWE that should be examined. It feels like CAPEC is the better option.
  • We expect this to be very cumbersome work - and it's only worth it, when it is done completely covering all the rules.
  • If we would be able to write the tags with the alerts, very interesting statistics could generated that would be of interest to a wider community far beyond ours.

What is CAPEC and what is the relationship to CWE?
https://cwe.mitre.org/about/faq.html#A.7 has the following to say: "While CWE is a list of software weakness types, Common Attack Pattern Enumeration and Classification (CAPEC™) is a list of the most common methods attackers use to exploit vulnerabilities resulting from CWEs. Used together, CWE and CAPEC provide understanding and guidance to software development personnel of all levels as to where and how their software is likely to be attacked, thereby equipping them with the information they need to help them build more secure software."

It is thus that CAPEC is more attack oriented and thus closer to our rules and their categories.

CAPEC Intro

@CRS-migration-bot
Copy link
Author

User csanders-git commented on date 2018-01-08 20:28:51:

We shall also go through and note the changes to OWASP top 10 tags

@CRS-migration-bot
Copy link
Author

User fzipi commented on date 2019-09-28 18:50:35:

Will try to get this done, based on what we discussed in the summit.

@CRS-migration-bot
Copy link
Author

User dune73 commented on date 2019-09-28 19:36:00:

That would be huge, Felipe!

@CRS-migration-bot
Copy link
Author

User fzipi commented on date 2019-10-26 11:22:24:

Yesterday I had a meeting with one potential student. He will begin playing with msc_pyparser to get a document with all tags per rule.

Officially he may start by the end of November. We'll see.

@CRS-migration-bot
Copy link
Author

User dune73 commented on date 2019-10-28 09:15:32:

This sounds very good. Is there anything we should do to make this work?

Also: Would this be a moment, where we get in touch with any OWASP projects that might profit from this / might be interested in our data? (First task: Find out which OWASP project might qualify).

@CRS-migration-bot CRS-migration-bot mentioned this issue May 13, 2020
Closed
@fzipi fzipi mentioned this issue Jul 4, 2020
Closed
@dune73
Copy link
Member
dune73 commented Aug 3, 2020

CAPEC tagging has been implemented in v3.3. We can thus close this long standing issue.

@dune73 dune73 closed this as completed Aug 3, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
⏲️ In progress
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@dune73 @CRS-migration-bot
0