Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What are the pros/cons of using a threat detection system for a web app (like OWASP's AppSensor)?

What does a properly implemented threat detection system do and how does it behave when it detects an attack?

What else do I need to know?

share|improve this question
add comment

3 Answers

Pros

  • Instant feedback, handling the issue before the damage is done.
  • Knowledge of what is happening in your web app. For example, who is where and other information.

cons:

  • Takes more resources.
share|improve this answer
add comment

You always have a default threat detection system. When your system goes down, or you discover a major security breach, you have just detected a threat. If that's acceptable maybe you don't need anything else.

On the other hand, with a formal "detection" system in place, expect a lot of trivial or nonexistent threats to be detected. Your general anxiety level will rise, and you'll spend a significant amount of time and effort mitigating the threats you see, worrying about the ones you can't do anything about, and apologizing to legitimate customers who were inconvenienced by all of the above.

share|improve this answer
add comment

Cons

  • False Positives or Positive Falses
  • Possibly Flooding of logs if designed incorrectly

Pros

  • Activly reports bad users
  • Helps moderate users

You can design your own system built into a app or get a external one, they basically just look for weird things they do such as asking for a lot of non-existent webpages and such.

share|improve this answer
    
Could you expand on why an incorrectly designed system would flood the logs. Or, more specifically, what a properly designed system looks like and how it behaves? –  VirtuosiMedia Nov 19 '10 at 12:08
1  
One problem you often see with such detection systems in the general world "safety" (not just cyber security) is that people can become too relient on them and lose their own 'guarded' perception of surroundings. I'd say that's the biggest con with using such systems, but it can easily be mitigated by diligence. –  DKGasser Jun 29 '11 at 15:59
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.