You have central logging going, detailed app logging/alerting (e.g. modsec), network based security alerting (e.g. snort), and whatever else feeding your observation deck. Do you have any cool ...
I am currently trying to implement some recommendations from OWASP AppSensor Project and I'd like to respond to attacker, when he tries to break into my website. Is there any resource ...
Do you have any insight, or experience (good or bad) regarding AlertLogic? In what areas can they improve, what areas are they lagging in?
Googling a port and protocol leads to a terse description at best, and a linkfarm in the average case. Most protocols on assorted, unknown high ports contain little or no plaintext, and often if the ...
I've been reading quite some time about anomaly/behavior based IDSes for Web servers. I understand the downsides: possible high false positives, learning phase, constant training. My question is how ...
A month ago, Stonesoft (an IDS constructor from Finland) has launched an alert about Advanced Evasion Techniques. With these techniques, they claim to be capable of launching attacks on a network ...
Suppose you are managing a team of Intrusion Detection Experts: ...what are the functional areas of the IDS knowledge space would you group your team into? ...how would you structure your team? ...
Start-ups and organizations with limited budgets that are security conscious are often encouraged to deploy intrusion detection stacks. Given that prevention will always fail, intrusion detection ...
I occasionally get clients requesting I look at their access_log file to determine if any web attacks were successful. What tools are helpful to discern attacks?
What are the pros/cons of using a threat detection system for a web app (like OWASP's AppSensor)? What does a properly implemented threat detection system do and how does it behave when it detects ...