How to prevent attacks due to Insufficient Logging & Monitoring?

Question

A10:2017-Insufficient Logging & Monitoring

This is one of OWASP Top 10 vulnerabilities. Given that we log and monitor sufficiently, how can this prevent an attack for example - attack where username and password is guessed over several attempts?

My point is that - such attack is prevented using measures like block or suspend account after 3 failed attempts.

Answer 1

There are a bunch of misunderstandings here about the OWASP Top 10 and what the different controls mean.

1. The OWASP Top 10 is not a list of vulnerabilities but a list of risks

2. Not all risks mean that there is an exploit that leads to a breach. Therefore, it does not mean that this weakness enables an attack. Nor does it mean that by having sufficient logging that it will prevent an attack.

There are different types of controls:

• Preventative
• Detective
• Compensating
• Corrective

3. As the A10:2017 entry points out, logs are a Detective control. If the system owner cannot see what is happening on the system, then the owner cannot respond to the attack. Being blind is a risk to the system, even if the system is operating within expected parameters.

As an example, security cameras do not prevent anything. But they help the security team look for anomalies and to see the extent of a problem, how it started, and everything that happened around the problem. It's the same thing for logs. Logs must be gathered and monitored and analysed.

Account lockouts are a Preventative control. It limits the attack in progress. Logs capture these attacks and allow the owner to do things like discover patterns in attacks or to discover successful attacks that were not prevented.

Security is a stack of protections just as digital technology is a stack of technologies. One control is not sufficient. Each layer helps protect the rest and the weakness in one layer can be compensated by the strength of others.