This thesis presents a novel approach to enhance the accessibility and flexibility of application-level security. It introduces a formal model of security controls that abstracts the low-level languages used by different Web Application Firewall (WAF) frameworks. The model is designed to simplify the definition of security capabilities through an XML-based abstract language, allowing administrators to specify security controls without needing detailed knowledge of the underlying frameworks. The model is enforced by a Java tool that translates the abstract language into framework-specific rules, addressing the challenges posed by the proliferation of diverse security tools. This approach reduces the risk of technology lock-in, enabling easier adoption of newer, more advanced frameworks.