What is a good method to receive security alerts?
Email is the first thing that springs to mind, although it is susceptible to MITM attacks (e.g. an attacker preventing the email from being delivered). Although this is not really a practical attack as the MITM will not usually be suitably placed for this to work (often email retrieval is done over SSL, and it is hard for attackers to intercept the actual delivery). There could be other attacks though such as the attacker DDoSing the mail server to prevent alerts from being received.
Text message sounds a good way, however the number of alerts triggered could be high and unsuitable for this format.
Another way may be a mobile app so that alerts can be received at anytime or anywhere. However, if the app is not currently installed alerts will not be received (e.g. users changing phones, etc, whereas formats such as email and text message are universal).
We are looking to monitor an inhouse, internet facing application deployed to the cloud from a security perspective and would like alerts such as the following to be logged and possibly alerted upon:
- Incorrect password attempts.
- Forms submitted with incorrect CSRF tokens.
- Attempted access to URLs that the user should not be able to access (e.g. if the user tries to go to
/Adminor if there is any parameter tampering -
/Project/1234is changed to
/Project/4567by the user).
In a nutshell, any security threats that can be handled internally by the application that we would like to know that has been attempted. We are not interested in trying to detect attempts at XSS or anything "extra" outside our application functionality, simply we would like to know when one of the existing security rules are triggered so we can monitor it and possibly act upon it. By security rules I mean the business logic within the application in order to secure it so this system would be actually implemented at code level to decide on what we should be alerting on.
Security events are already logged, however checking these logs is a manual process. We could introduce the concept of thresholds to reduce false positives. i.e. one incorrect password attempt is only logged, however 5 incorrect attempts in a row against an account of from a particular IP triggers an alert.
So to summarize I am looking for a secure and reliable way to be alerted when a security event is triggered. Either through custom code or some other method as I have a feeling that this is an already solved problem. This will be combined with IDS in future, so this is purely from the internal perspective of the application.
I am currently thinking that text and email solution might be suitable, however the text and email trigger only once and only display a link to log into the monitoring application to view activity.