Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm thinking of following OWASP's AppSensor project to build application-level intrusion detection into an existing open source web application.

I think there is some value in using AppSensor to detect generic, automated attacks. However, AppSensor seems less valuable against attacks directed at this application because anyone could run the application locally to understand how their attacks would be detected.

Is it worth fully following OWASP AppSensor for an open source web application, or would it be a more efficient use of time and effort to only try to detect automated attacks?

share|improve this question

All security efforts are an investment. Each produce a different return on your investment. I often tell people to put effort into the security practices that give the most return in terms of bugs found, attacks prevented, etc. The best use of time on an open source project would be reviews for common vulnerabilities (e.g OWASP Top 10), configuration issues, etc. Then submit fixes for what you find.

share|improve this answer

Nick P is correct - it is certainly better to attempt to find vulnerabilities first, and have processes to help prevent these getting into production. Depending upon your application, there might well be some benefit in knowing a user's intent.

We've just completed a new AppSensor Guide:

Free to download from:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.