Application Intrusion Detection

Transcript

1. COMMUNITY TOPICS Welcome InfoSecNZ Slack, OWASP Slack Anything else people want to mention? Tonights talk (Chris - Incident Response), (Me - Application Intrusion Detection) 
2. APPLICATION INTRUSION DETECTION 
3. HIDS, NIDS, AIDS? 
4. 1. Asset Identification 2. Identify Risks 3. Countermeasures 4. Risks that Solution Causes 5. Costs and Trade-offs 
5. 1. SSM Asset Identification 
6. 2. SSM Identify Risks 
7. Lack of Visibility Insufficient Logging (->) & Monitoring (<-) Covered in for OWASP Top 10 Insufficient Attack Protection Book -> Holistic Info-Sec for Web Developers No. 10 Lack of Active Automated Prevention 
8. 3. SSM Countermeasures 
9. Lack of Visibility ... Detection works where prevention fails and detection is of no use without response Bruce Schneier 
10. Lack of Visibility OWASP Top 10 - Insufficient Logging Insufficient Monitoring A10 Kim's book 
11. WAF App Intrusion Detection & Response Active Automated Prevention Insufficient Attack Protection 
12. App Intrusion Detection->Prevention is reactive 
13. By being proactive -> SAST, DAST 
14. It's been 8 years now in alpha and releases being published regularly purpleteam It's time to let someone else take over Pete Nicholls is taking over from me Next Meetup Last Wed of Sep - Pete & Toni - Ask anything panel 