Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Application Intrusion Detection

Sponsored · Ship Features Fearlessly Turn features on and off without deploys. Used by thousands of Ruby developers. →
Avatar for Kim Carter Kim Carter
July 03, 2021
Technology
550
0

Application Intrusion Detection

Avatar for Kim Carter

Kim Carter

July 03, 2021

More Decks by Kim Carter

See All by Kim Carter
owaspnz-chch-meetup-2021-workshop-planning-and-covid
Avatar for Kim Carter binarymist
0
590
Security Regression Testing on OWASP Zap Node API
Avatar for Kim Carter binarymist
1
10k
Building purpleteam (a Security Regression Testing SaaS) - From PoC to Alpha
Avatar for Kim Carter binarymist
0
1.4k
OWASP Quiz Night
Avatar for Kim Carter binarymist
2
1.3k
The Art of Exploitation
Avatar for Kim Carter binarymist
2
1.2k
Developing a High Performance Security Focussed Agile Team (2 hr workshop)
Avatar for Kim Carter binarymist
1
840
OWASP NZ Day 2016
Avatar for Kim Carter binarymist
0
210
Infectious Media with Rubber Ducky
Avatar for Kim Carter binarymist
1
630
0wn1ng The Web at www.wdcnz.com
Avatar for Kim Carter binarymist
2
1.9k

Other Decks in Technology

See All in Technology
知ってた？JavaScriptの"正しさ"を検証するテストが5万以上もあること(Test262)
Avatar for Riya Amemiya riyaamemiya
1
140
「QA＝テスト」「シフトレフト＝スクラムイベントの参加者の一員」の呪縛を解く。アジャイルな開発を止めないために、10Xで挑んだ「右側のしわ寄せ」解消記 #scrumniigata
Avatar for nihonbuson nihonbuson
PRO
3
810
Scovilleモバイルエンジニア募集中.pdf
Avatar for Julien Rudin julienrudin
0
150
Modernizing Your HCL Connections Experience: Visual Report to chain, Profile Enhancements, and AI Integration
Avatar for Wannes Rams wannesrams
0
280
EMから幅を広げるために最近挑戦していること / Recent challenges I'm undertaking to expand my horizons beyond EM
Avatar for hiro-torii hiro_torii
1
180
サービスの信頼性を高めるため、形骸化した「プロダクションミーティング」を立て直すまでの取り組み
Avatar for すてにゃん stefafafan
1
230
毎日の作業を Claude Code 経由にしたら、 ノウハウがコードになった
Avatar for Hajime KOSHIRO kossykinto
0
220
需要創出(Chatwork)×供給(BPaaS) フライホイールとMoat 実行能力の最適配置とAI戦略
Avatar for kubell kubell_hr
0
2k
AIが盛んな時代に 技術記事を書き始めて起きた私の中での小さな変化
Avatar for 松尾淳平 peintangos
0
350
MySQL 9.7がやってきた ～これまでのあらすじと基本情報～ @ 日本MySQLユーザ会会2026年04月 / mysql97-yattekita
Avatar for sakaik sakaik
0
170
【技術書典20】OpenFOAM（自宅で深める流体解析）流れと熱移動（２）
Avatar for kamakiri1225 kamakiri1225
0
370
Agents CLI と Gemini Enterprise Agent Platform で マルチエージェント開発が楽しくなる！
Avatar for Kaz kaz1437
0
240

Featured

See All Featured
DevOps and Value Stream Thinking: Enabling flow, efficiency and business value
Avatar for Helen Beal helenjbeal
1
180
How To Stay Up To Date on Web Technology
Avatar for Chris Coyier chriscoyier
790
250k
SEOcharity - Dark patterns in SEO and UX: How to avoid them and build a more ethical web
Avatar for Sara Fernández Carmona sarafernandez
0
180
Into the Great Unknown - MozCon
Avatar for Noah Learner thekraken
41
2.4k
Gemini Prompt Engineering: Practical Techniques for Tangible AI Outcomes
Avatar for Mfonobong Umondia mfonobong
2
380
Rebuilding a faster, lazier Slack
Avatar for samanthasiow samanthasiow
85
9.5k
How to make the Groovebox
Avatar for あそなす asonas
2
2.2k
The browser strikes back
Avatar for Jono Alderson jonoalderson
0
1k
Agile Actions for Facilitating Distributed Teams - ADO2019
Avatar for Mark Kilby mkilby
0
180
No one is an island. Learnings from fostering a developers community.
Avatar for Antonio thoeni
21
3.7k
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
Avatar for soudai sone soudai
PRO
199
73k
The Straight Up "How To Draw Better" Workshop
Avatar for Dennis Kardys denniskardys
239
140k

Transcript

  1. COMMUNITY TOPICS Welcome InfoSecNZ Slack, OWASP Slack Anything else people

    want to mention? Tonights talk (Chris - Incident Response), (Me - Application Intrusion Detection) 

  2. APPLICATION INTRUSION DETECTION 

  3. HIDS, NIDS, AIDS? 

  4. 1. Asset Identification 2. Identify Risks 3. Countermeasures 4. Risks

    that Solution Causes 5. Costs and Trade-offs 

  5. 1. SSM Asset Identification 

  6. 2. SSM Identify Risks 

  7. Lack of Visibility Insufficient Logging (->) & Monitoring (<-) Covered

    in for OWASP Top 10 Insufficient Attack Protection Book -> Holistic Info-Sec for Web Developers No. 10 Lack of Active Automated Prevention 

  8. 3. SSM Countermeasures 

  9. Lack of Visibility ... Detection works where prevention fails and

    detection is of no use without response Bruce Schneier 

  10. Lack of Visibility OWASP Top 10 - Insufficient Logging Insufficient

    Monitoring A10 Kim's book 

  11. WAF App Intrusion Detection & Response Active Automated Prevention Insufficient

    Attack Protection 

  12. App Intrusion Detection->Prevention is reactive 

  13. By being proactive -> SAST, DAST 

  14. It's been 8 years now in alpha and releases being

    published regularly purpleteam It's time to let someone else take over Pete Nicholls is taking over from me Next Meetup Last Wed of Sep - Pete & Toni - Ask anything panel 