What are the pros/cons of using a threat detection system for a web app (like OWASP's AppSensor)?
What does a properly implemented threat detection system do and how does it behave when it detects an attack?
What else do I need to know?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this communityWhat are the pros/cons of using a threat detection system for a web app (like OWASP's AppSensor)?
What does a properly implemented threat detection system do and how does it behave when it detects an attack?
What else do I need to know?
Pros
cons:
Cons
Pros
You can design your own system built into a app or get a external one, they basically just look for weird things they do such as asking for a lot of non-existent webpages and such.
You always have a default threat detection system. When your system goes down, or you discover a major security breach, you have just detected a threat. If that's acceptable maybe you don't need anything else.
On the other hand, with a formal "detection" system in place, expect a lot of trivial or nonexistent threats to be detected. Your general anxiety level will rise, and you'll spend a significant amount of time and effort mitigating the threats you see, worrying about the ones you can't do anything about, and apologizing to legitimate customers who were inconvenienced by all of the above.