Secure alerting for a monitored web application

Question

What is a good method to receive security alerts?

Email is the first thing that springs to mind, although it is susceptible to MITM attacks (e.g. an attacker preventing the email from being delivered). Although this is not really a practical attack as the MITM will not usually be suitably placed for this to work (often email retrieval is done over SSL, and it is hard for attackers to intercept the actual delivery). There could be other attacks though such as the attacker DDoSing the mail server to prevent alerts from being received.

Text message sounds a good way, however the number of alerts triggered could be high and unsuitable for this format.

Another way may be a mobile app so that alerts can be received at anytime or anywhere. However, if the app is not currently installed alerts will not be received (e.g. users changing phones, etc, whereas formats such as email and text message are universal).

We are looking to monitor an inhouse, internet facing application deployed to the cloud from a security perspective and would like alerts such as the following to be logged and possibly alerted upon:

• Incorrect password attempts.
• Forms submitted with incorrect CSRF tokens.
• Attempted access to URLs that the user should not be able to access (e.g. if the user tries to go to /Admin or if there is any parameter tampering - /Project/1234 is changed to /Project/4567 by the user).

In a nutshell, any security threats that can be handled internally by the application that we would like to know that has been attempted. We are not interested in trying to detect attempts at XSS or anything "extra" outside our application functionality, simply we would like to know when one of the existing security rules are triggered so we can monitor it and possibly act upon it. By security rules I mean the business logic within the application in order to secure it so this system would be actually implemented at code level to decide on what we should be alerting on.

Security events are already logged, however checking these logs is a manual process. We could introduce the concept of thresholds to reduce false positives. i.e. one incorrect password attempt is only logged, however 5 incorrect attempts in a row against an account of from a particular IP triggers an alert.

So to summarize I am looking for a secure and reliable way to be alerted when a security event is triggered. Either through custom code or some other method as I have a feeling that this is an already solved problem. This will be combined with IDS in future, so this is purely from the internal perspective of the application.

I am currently thinking that text and email solution might be suitable, however the text and email trigger only once and only display a link to log into the monitoring application to view activity.

Answer 1

Nagios has a feature that detects what is called "flapping" which you could implement yourself. Basically it will start sending you text messages, but will stop if it passes a certain tresshold within a given timeframe for a similar type of warning message. It's up to you to decide the thressholds and the intervals and the classification of the events.

Text messaging and email is a good idea for monitoring. But make sure to also log a ticket for each incident and ensure that for every closed ticket a detailed resolution or response is given (just email doesn't provide enough traceability).

You can also use logstash and kibana or if you are a bit richer Splunk to perform automated data agregation and dashboarding to make the process less painful when checking the logs.

Answer 2

Email and SMS are plain text solution. You can put a public key on the server and have it encrypt any alerts sent over any medium so they are unreadable and can only be decrypted by the authorized recipients. The encryption piece would give you confidentiality. This would also provide some degree of integrity because a fake alert could only be inserted if the server was compromised, MitM successfully modifying the ciphertext as the email or SMS is traveling around the net is far less likely.

From the availability side, you may want to use multiple methods. If the data is encrypted, why not send SMS, email, have it written to a log - maybe RSS, etc. You can also require some type of heartbeat detection and then take action if you are not receiving the heartbeat after some period of time. To ensure that individual messages are not missed, you may want to ensure each message has an incrementing serial number.