Application Intrusion Detection

Slide 1

Slide 1 text

COMMUNITY TOPICS Welcome InfoSecNZ Slack, OWASP Slack Anything else people want to mention? Tonights talk (Chris - Incident Response), (Me - Application Intrusion Detection) 

Slide 2

Slide 2 text

APPLICATION INTRUSION DETECTION 

Slide 3

Slide 3 text

HIDS, NIDS, AIDS? 

Slide 4

Slide 4 text

1. Asset Identification 2. Identify Risks 3. Countermeasures 4. Risks that Solution Causes 5. Costs and Trade-offs 

Slide 5

Slide 5 text

1. SSM Asset Identification 

Slide 6

Slide 6 text

2. SSM Identify Risks 

Slide 7

Slide 7 text

Lack of Visibility Insufficient Logging (->) & Monitoring (<-) Covered in for OWASP Top 10 Insufficient Attack Protection Book -> Holistic Info-Sec for Web Developers No. 10 Lack of Active Automated Prevention 

Slide 8

Slide 8 text

3. SSM Countermeasures 

Slide 9

Slide 9 text

Lack of Visibility ... Detection works where prevention fails and detection is of no use without response Bruce Schneier 

Slide 10

Slide 10 text

Lack of Visibility OWASP Top 10 - Insufficient Logging Insufficient Monitoring A10 Kim's book 

Slide 11

Slide 11 text

WAF App Intrusion Detection & Response Active Automated Prevention Insufficient Attack Protection 

Slide 12

Slide 12 text

App Intrusion Detection->Prevention is reactive 

Slide 13

Slide 13 text

By being proactive -> SAST, DAST 

Slide 14

Slide 14 text

It's been 8 years now in alpha and releases being published regularly purpleteam It's time to let someone else take over Pete Nicholls is taking over from me Next Meetup Last Wed of Sep - Pete & Toni - Ask anything panel 