Is it worth following OWASP AppSensor for an open source web application?

Question

I'm thinking of following OWASP's AppSensor project to build application-level intrusion detection into an existing open source web application.

I think there is some value in using AppSensor to detect generic, automated attacks. However, AppSensor seems less valuable against attacks directed at this application because anyone could run the application locally to understand how their attacks would be detected.

Is it worth fully following OWASP AppSensor for an open source web application, or would it be a more efficient use of time and effort to only try to detect automated attacks?

Answer 1

All security efforts are an investment. Each produce a different return on your investment. I often tell people to put effort into the security practices that give the most return in terms of bugs found, attacks prevented, etc. The best use of time on an open source project would be reviews for common vulnerabilities (e.g OWASP Top 10), configuration issues, etc. Then submit fixes for what you find.

Answer 2

Nick P is correct - it is certainly better to attempt to find vulnerabilities first, and have processes to help prevent these getting into production. Depending upon your application, there might well be some benefit in knowing a user's intent.

We've just completed a new AppSensor Guide:

https://www.clerkendweller.com/2014/5/6/AppSensor-Guide-v20-Released

Free to download from:

https://www.owasp.org/index.php/OWASP_AppSensor_Project

Answer 3

There is a book Agile Application Security: Enabling Security in a Continuous Delivery Pipeline that mentions AppSensor. More importantly it mentions all the other things you might do to secure your app. The book is quite repetitive (multiple authors who seem to have written on the same topics) yet it has a wealth of ideas about where to spend your effort. For example it would seem more important that if you are working with a given framework to spend effort making sure it's is security defect free before implementing any intrusion detection features.

Looking at AppSensor and taking a glance at the features it includes it does look to identify a whole load of attack patterns like trying to use http methods you don’t support or missing parameters. That is gong to catch both client code bugs and scripted or manual attacks. The question of ”is it worth implementing AppSensor” is an interesting question. Will it diffdifferentiate the web framework you are promoting? If so it sounds like a good idea. If it won't differentiate then that implies other web frameworks already have it (or alternatives) in which case it seems like a good idea to add it.

I would certainly appreciate it if the web application frameworks I use had it.