Icj-Ch 09 - Logging, Error Handling, And Intrusion Detection

Front 1

¿QUE ES CWE?

Back 1

The MITRE corporation manages the Common Weakness Enumeration (CWE), a community-developed dictionary of software weaknesses.

http://cwe.mitre.org/index.html
P222

Front 2

¿CUAL ES LA MISION DE LOGGING EN SOFTWARE SEGURO?

Back 2

The
mission of logging in secure software is to make it as easy as possible for investigators to answer these questions:
■ What happened?
■ Who did it?
■ When did it happen?
■ How was our security circumvented?
■ What data was viewed or modified?
■ How can we prevent this from happening again?
P222

Front 3

¿CUAL ES LA MEJOR PRACTICA DE LOGUEO CON RESPECTO A LA SESSION ID?

Back 3

Do not log the user’s session ID because this could leak critical authentication data to insiders!
Instead, log a hash of the session ID so you can reference multiple log entries to the same session
without exposing the session ID itself
P223

Front 4

¿QUE DEBE BITACOREARSE?

Back 4

HINT: USERNAME, IP ADDRESS, TIE ALL LOG ENTRIES FROM A PARTICULAR SESSION TOGETHER
TRANSACTION ID OR ACTIVITY ID
P223

Front 5

MENCIONE LA LISTA DE EVENTOS RELACIONADOS CON SEGURIDAD QUE DEBEN SER LOGUEADOS.

Back 5

TIP
Consider prioritizing or highlighting log entries of actions conducted by highly privileged users, such
as admin or super user accounts.
■ Successful logins
■ Failed logins
■ Logouts
■ Password or security question changes
■ Profile changes, such as a change of email address
■ Password reset attempts
■ New user registration
■ User de-registration
■ Authorization failures
■ Changes to access levels, such as granting admin or superuser access
■ Operational activities, such as backups (for example, exporting my Twitter feed)
■ Any system administration activity
■ Significant input validation failures
■ Any other sensitive operation…
P224

Front 6

¿QUE NO DEBE BITACOREARSE?

Back 6

HINT: APP-SPECIFIC SENSITIVE DATA THAT COULD ASSIST AN ATTACKER, E.G. SESSINO ID, PERSONAL INFORMATION
P224

Front 7

DADA UNA APLICACION CON MULTIPLES MECANISMOS DE SEGURIDAD, ¿QUE MECANISMO ES COMUNMENTE UN CASO DE FUGA DE SEGURIDAD?

Back 7

HINT: FRAMEWORKS QUE INCLUYEN METODOS DE CONVENIENCIA PARA DESARROLLO QUE BITACOREA REQUESTS COMPLETOS, INCLUYENDO PASSWORDS, CREDIT CARD NUMBERS, SOCIAL SEC NUMBERS, ETC.
WWW.IEEELOG.COM
P225

Front 8

MENCIONE EJEMPLOS DE FRAMEWORKS DE BITACOREO ENFOCADOS EN SEGURIDAD. INDIQUE EL PREFERIDO Y POR QUE

Back 8

HINT: ESAPI, LOGBACK (MARKERS, MAPPED DIAGNOSTIC CONTEXT MDCs, SLF4J)
P226

Front 9

¿QUE ES ESAPI PROJECT?

Back 9

One of the earlier attempts at security-centric logging is the OWASP ESAPI project for Java. 5 ESAPI is a security library that includes specific and granular APIs for security-centric logging. Although this project is not necessarily production quality, it still provides a good example of the type of requirements that senior security professionals seek in logging software.
P226

Front 10

¿CUAL ES EL OBJETIVO DE ESAPI PROJECT?

Back 10

The goal of ESAPI logging is simple: Provide an API that allows developers to easily make a log entry that includes a timestamp from a reliable source, severity level of the event, an indication that this is a security-relevant event
(if mixed with other logs), the identity of the user that caused the event (if there is a user associated with the event), the source IP address of the request associated with the event, whether the event succeeded or failed, and a
description of the event.
P226

Front 11

DESCRIBA EL PROYECTO LOGBACK, Y CUAL ES PREFERIDO VS ESAPI Y POR QUE.

Back 11

P230

Front 12

¿QUE INFORMACION SENSIBLE SE PUEDE MOSTRAR EN EL BROWSER EN CASO DE NO GESTIONAR CORRECTAMENTE LOS CASOS DE ERROR?

Back 12

HINT: DEV LANGUAGE, LIBRARIES, EXACT VERSION OF SERVER, AND POSIBLE SQL INJECTION VULNERABILITY IN CASE ITS AN SQL ERROR
P231

Front 13

DESCRIBA LA MEJOR PRACTICA PARA MANEJO DE ERRORES EN UNA APLICACION WEB.

Back 13

HINT: USAR WEB.XML PARA MOSTRAR UNA PAGINA DEFAULT EN CASO DE EXCEPCIONES NO CAPTURADAS.
PROVEER UN NUMERO UNICO DE REFERENCIA (EJ. ID).
CUSTOM ERROR PAGES FOR HTTP ERROR CODES, TO PREVENT THE SERVER'S DEFAULT PAGES (WHICH OFTEN REVEAL SERVER VERSION NUMBERS)
P232

Front 14

ELEMENTO DE WEB.XML PARA DEFINIR PAGINAS CUSTOM PARA EL MANEJO DE ERRORES NO CAPTURADOS.

Back 14

HINT:
P232

Front 15

MENCIONE EJEMPLOS DE HERRAMIENTAS PARA SQL INJECTION Y DETECCION DE VULNERABILIDADES.

Back 15

SQLMAP
HAVIJ
ACUNETIX
P234

Front 16

MENCIONE EJEMPLOS DE INTENTOS OBVIOS DE ATAQUE Y SUS ESTRATEGIAS DE DETECCION.

Back 16

SIMPLE TECHNIQUES FOR XSS
SEARCHING FOR USER INPUT WITH COMMON XSS ATTACK PATTERNS
SQL INJECTION DETECTION EFFORTS
DETECT MALICIOUS TOOLS THEMSELVES THROUGH THEIR USER AGENT STRINGS AND CORRUPT HTTP HEADERS
P234

Front 17

MENCIONE EJEMPLOS DE INTERCEPTING PROXY TOOLS

Back 17

OWASP ZAP
BURP PROXY
PAROS PROXY
WEBSCARAB
TAMPER DATA
P235

Front 18

DESCRIBA LA VULNERABILIDAD DE DETECCION DE INTRUSOS INPUT VIOLATION OF IMMUTABLE FORM COMPONENTS. ¿CON QUE HERRAMIENTA SE PUEDE LLEVA A CABO? ¿COMO SE DETECTA? ¿QUE MEDIDA SE RECOMIENDA COMO RESPUESTA?

Back 18

HINT: RADIO BUTTONS

OWASP ZAP
BURP PROXY
PAROS PROXY
WEBSCARAB
TAMPER DATA

BLOQUEAR CUENTA DEL USUARIO
P234

Front 19

MENCIONE TECNICAS VS ATAQUES AUTOMATIZADOS.

Back 19

CSRF TOKENS
FORM POLYMORPHISM
HONEY TOKEN COMPONENT
P237

Front 20

¿EN QUE CONSISTE LA TECNICA DE PROGRAMACION DE FORM POLYMORPHISM Y VS QUE SE UTILIZA? MENCIONE UN CASO DE EJEMPLO.

Back 20

HINT: ATAQUES AUTOMATIZADOS. LOGIN FORM
P238

Front 21

¿EN QUE CONSISTE LA TECNICA DE HONEY TOKEN FORM COMPONENT Y VS QUE SE UTILIZA? MENCIONE UN CASO DE EJEMPLO.

Back 21

HINT: TEXT FIELD WITH CSS OFF-PAGE FOR AUTOMATED BOTS.

THEY SHOULD BE EMPTY AT SERVER SIDE
P238

Front 22

¿QUE ES OWASP AppSensor?

Back 22

The OWASP AppSensor project17 is an open-source framework for real-time attack detection and response. That means your application can actually detect intruders and protect itself! AppSensor performs a similar function to a network layer intrusion detection system, but operates at the application layer.
P239

Front 23

¿CUALES SON LOS COMPONENTES DE OWASP AppSensor? ¿CUALES ESTAN EN LA APLICACION Y CUALES EN EL FRAMEWORK? DESCRIBIR COMPONENTES

Back 23

DETECTION POINTS
ANALYSIS ENGINE (AND POLICY CONFIGURATION)
RESPONSE EXECUTION
P240