What are the pros/cons of using a threat detection system for a web app (like OWASP's AppSensor)?
What does a properly implemented threat detection system do and how does it behave when it detects an attack?
What else do I need to know?
asked Nov 12 '10 at 0:16
Add a comment
|
Pros
- Instant feedback, handling the issue before the damage is done.
- Knowledge of what is happening in your web app. For example, who is where and other information.
cons:
- Takes more resources.
Cons
- False Positives or Positive Falses
- Possibly Flooding of logs if designed incorrectly
Pros
- Activly reports bad users
- Helps moderate users
You can design your own system built into a app or get a external one, they basically just look for weird things they do such as asking for a lot of non-existent webpages and such.
-
Could you expand on why an incorrectly designed system would flood the logs. Or, more specifically, what a properly designed system looks like and how it behaves? – VirtuosiMedia Nov 19 '10 at 12:08
-
1One problem you often see with such detection systems in the general world "safety" (not just cyber security) is that people can become too relient on them and lose their own 'guarded' perception of surroundings. I'd say that's the biggest con with using such systems, but it can easily be mitigated by diligence. – DKGasser Jun 29 '11 at 15:59
You always have a default threat detection system. When your system goes down, or you discover a major security breach, you have just detected a threat. If that's acceptable maybe you don't need anything else.
On the other hand, with a formal "detection" system in place, expect a lot of trivial or nonexistent threats to be detected. Your general anxiety level will rise, and you'll spend a significant amount of time and effort mitigating the threats you see, worrying about the ones you can't do anything about, and apologizing to legitimate customers who were inconvenienced by all of the above.
