20 March 2015


Posts relating to the category tag "monitoring" are listed below.

20 March 2015

The Hard Problem of Securing Enterprise Applications

This paper about securing enterprise applications has been sitting in my email since November. I eventually got round to reading it and apologise for not highlighting it sooner.

Vendor recommended security controls and compliance requirements leave huge gaps in application security. ... Most have no understanding of how the application platforms work, where security events should be collected, nor how to analyze application specific information.

Securing Enterprise Applications describes the problems modern enterprises have with application security: security use cases, security gaps and recommendations. These are my favourite selective snippets. This:

The biggest gap and most pressing need is that most monitoring systems do not understand enterprise applications. To continuously monitor enterprise applications you need to collect the appropriate data and then make sense of it.


Traditional application security vendors who claim "deep packet inspection" for enterprise application security skirt understanding how the application actually works.


Continuous monitoring of enterprise application activity, with full understanding of how that application works, is the most common gap in enterprise security strategies.


This means that you can block activity, not just monitor. Properly configured with white/black listing, they help prevent exploitation of 0-day attacks and filter out other unwanted behavior. They work at the application layer so they are typically deployed one of three ways: as an agent on the application platform, as a reverse proxy for the application, or embedded into the application itself.

Read and implement AppSensor. It's free.

Posted on: 20 March 2015 at 08:16 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

17 February 2015

AppSensor Now A Flagship OWASP Project

I was extremely pleased at the release of the v2 AppSensor reference implementation inJanuary. Now I am excited that the Open Web Application Security Project (OWASP) has elevated the project's status.

Photograph of a green pendant flag flying against a blue sky

The completely voluntary OWASP project task force, led by Johanna Curiel, has been working through a backlog of project reviews. Over the last couple of years OWASP AppSensor Project has delivered significant steps in the coverage, quality, and depth of outputs. In fact it is also the only OWASP project that is both a documentation type of project, and a code one.

OWASP has promoted the project to the highest level - Flagship status. As co-leader with John Melton and Dennis Groves, and project founder Michael Coates, I am thrilled with this recognition.

OWASP's project inventory includes nine other Flagship projects and defines flagship status as:

The goal of OWASP Flagship projects is to identify, highlight, and support mainstream OWASP projects that make up a complete application security product of high quality and value to the software security industry. These projects are selected for their strategic value to OWASP and application security as a whole.

OWASP Flagship projects represent projects that are not only mature, but are also projects that OWASP as an organization provides direct support to maintaining. The core mission of OWASP is to make application security visible and so as an organization, OWASP has a vested interest in the success of its Flagship projects. Since Flagship projects have such high visibility, these projects are expected to uphold the most stringent requirements of all OWASP Projects.

It is important to remember all the people who have volunteered their time and effort to reach this stage. So many good and generous people.

Mark Miller has just interviewed John Melton about the OWASP AppSensor Project as part of the OWASP 24/7 podcast series. He provides an overview of application-specific attack detection and response, discusses what is new in version 2.0.0, explains the architectural options, describes the process flow, and mentions what else is on the roadmap.

AppSensor will be participating in this year's AppSec EU application security conference in Amsterdam, from 19th to 22nd May 2015. I hope you can make it.

Posted on: 17 February 2015 at 07:55 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

29 January 2015

Anti-Automation Monitoring and Prevention

It seems London's Heathrow Airport has very little in the way of anti-automation monitoring or prevention in place.

Headline from the London Evening Standard which reads 'Heathrow noise complaints sent by automated software'

According to the London Evening Standard newspaper on Tuesday, a five-fold increase in complaints was in large part due to automated email submission.

Luck would seem to have been what led to the discovery that the emails were computer-generated when complaints were received an hour ahead of the flight schedule after the clocks changed from summer time.

Oops, let's hope that's not a metric used by the airport itself or a regulator.

Not that the airport would reasonably believe it to be the target of any activists! Surely not.

Posted on: 29 January 2015 at 16:04 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

17 December 2014

Business Failure at the Speed of Software

This week we saw two events where the automated nature of processes lead to major business failures.

Partial extract from the RepricerExpress showing some of the liability clauses in its terms and conditions of service published at http://www.repricerexpress.com/terms-and-conditions/

On Friday, a number of Amazon retailers were affected by a pricing problem. Those that had chosen to subscribe to the third-party RepricerExpress service that automatically adjusts prices to match or better competitors, found their products were being sold for as little as 1 pence. Those organisations that despatched their own goods were able to spot the problem themselves, but those that used Amazon to stock and ship product, were affected more seriously because Amazon simply carried on regardless for some time.

The cause of the hour-long issue has been fixed. RepricerExpress's clients are outraged, and of course for some of them this could put them out of business. I am sure RepricerExpress will be reminding its clients what they agreed to in the RepricerExpress end user licence agreement (partial screenshot in the image above). Including for example that the maximum liability "shall be limited to a sum equal to the total Licence Fees paid to the Licensor in the period of 12 months considered retrospectively from the date the cause of action arose". So, how much would you pay for something that can reduce your product prices by almost 100%? £20-70 per month apparently seems to be the answer.

Express indeed.

Then on Monday, taxi-like company Uber, which had another PR disaster last month, managed to incense everyone by rapidly escalating its prices in Sydney as "demand increased" i.e. people attempted to leave the city during the dreadful cafe hostage event. Later reacting to pressure, Uber cancelled the change and offered some free services instead and a refund to those affected by its pricing.

These have a common factor of automated software making unmoderated changes to pricing that would clearly be perceived as unreasonable to a human. And doing it fast.

Superfast fail.

Automation is good — but enumerate all the possibilities, and implement limits, checks and alerts. And monitor these. And more importantly, check your contracts and who is liable for what. Then do a risk assessment and make sure someone senior reviews this and makes some decision about the risks. Can you survive the unexpected?

Posted on: 17 December 2014 at 17:23 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

20 November 2014

TRUSTe Privacy Deception and Misrepresentation

US regulator Federal Trade Commission (FTC) has taken to task self-appointed privacy certifier TRUSTe (True Ultimate Standards Everywhere, Inc.) which labels itself as "powering trust and compliance".

Partial screen capture of a page from the TRUSTe web site showing some of its web privacy certification products

In a press release issued this week, the FTC states that TRUSTe has agreed to settle charges that it "deceived consumers about its recertification program for company's privacy practices, as well as perpetuated its misrepresentation as a non-profit entity".

Apart from a $200,000 fine, the proposed extensive settlement requires "TRUSTe will be prohibited from making misrepresentations about its certification process or timeline, as well as being barred from misrepresenting its corporate status or whether an entity participates in its program. In addition, TRUSTe must not provide other companies or entities the means to make misrepresentations about these facts, such as through incorrect or inaccurate model language.".

TRUSTe CEO Chris Babel's comment about the settlement can be found on the TRUSTe blog.

The United Kingdom TRUSTe web site is http://www.truste.co.uk/ which lists many UK clients. Sadly, a Google search indicates many of their clients haven't realised what's been going on and are still promoting the label.

Posted on: 20 November 2014 at 14:15 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

25 July 2014

Creative Content UK Alert Programme

An industry-led initiative will replace plans for the UK government's Digital Economy Act (DEA) copyright regime.

BT, Sky, Virgin and TalkTalk have committed to sending out up to four warning letters to each customer a year if their accounts have been identified as being used to breach copyright laws

The plans, announced just over a week ago, primarily relate to P2P file sharing of music, TV and movies, but may be of use to other content producers. Read the Virgin Media's blog post from and the press release from trade body BPI.

There is an in depth write-up on the Out-Law.com legal news site, and further comment here and also here.

Posted on: 25 July 2014 at 14:00 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

13 June 2014

Characterising Fraudulent Online Customers

Payment processor 2Checkout has launched a new quarterly report detailing payment fraud trends.

Partial view of one of the charts from 2Checkout Fraud Index 2014Q1

2Checkout Fraud Index 2014 Quarter 1 contains information from the company's own checkout and payment fraud monitoring systems, cross tabulated against other observed buyer characteristics.

The report includes data on and ranks buyer fraud by:

  • Credit card issuer
  • Billing address
  • IP address
  • Currency
  • Cross border status
  • Product type
  • Value of transaction.

Any prior national prejudices might be challenged. Useful stuff if your are running your own online fraud monitoring system and setting thresholds for potential fraud alerts.

Posted on: 13 June 2014 at 09:35 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

10 May 2014

AppSensor Guide Part VI: Reference Materials

This post describes Part VI, the final part, of the new OWASP AppSensor Guide v2.0, published on 2nd May.

Photograph of a street barrier with a notice stating 'Caution - Traffic management Trial - Do Not Move'

"Part VI: Reference Materials" comprises seven sections:

  • Glossary
  • Detection Points
  • Responses
  • Data Signaling Exchange Formats
  • Awareness and Training Resources
  • Feedback and Testimonials
  • References.

Part VI includes the primary information sources including all the lists and details about detection point types and the response types. This part therefore includes a quarter of the 40 tables and 51 figures included in the guide.

Updates to these and further reference materials are maintained on the OWASP AppSensor Project website.

Previous posts describe the other parts of the new guide.

Posted on: 10 May 2014 at 12:12 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

09 May 2014

AppSensor Guide Part V : Model Dashboards

This post describes what is in Part V of the new OWASP AppSensor Guide v2.0, published on 2nd May.

Photograph of a technician lying on the ground in the middle of a street behind a barrier, working on a display sign

"Part V : Model Dashboards" comprises three shorter chapters:

  • Chapter 27 : Security Event Management Tools
  • Chapter 28 : Application-Specific Dashboards
  • Chapter 29 : Application Vulnerability Tracking.

Part V introduces the necessary concepts for visualising AppSensor data, and presents example application-specific dashboards that have already been created.

Data visualisation of real-time attack detection and response provides organisations with much needed insight into whether their applications are under attack, and by whom.

Previous and a subsequent post describe the other parts of the new guide.

Posted on: 09 May 2014 at 15:19 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

09 May 2014

AppSensor Guide Part IV : Demonstration Implementations

This post describes what is in Part IV of the new OWASP AppSensor Guide v2.0, published on 2nd May.

Photograph of a wooden gate to a field, with a sign 'Beware of Bull' on it, with verdant green grass and coniferous trees behind

"Part IV : Demonstration Implementations" comprising seven chapters, each three pages long, describes model implementations:

  • Chapter 20 : Web Services (AppSensor WS)
  • Chapter 21 : Fully Integrated (AppSensor Core)
  • Chapter 22 : Light Touch Retrofit
  • Chapter 23 : Ensnare for Ruby
  • Chapter 24 : Invocation of AppSensor Code Using Jni4Net
  • Chapter 25 : Using an External Log Management System
  • Chapter 26 : Leveraging a Web Application Firewall.

Part IV provides practical examples of how the AppSensor concept can be deployed, including some standalone components that could be utilised within an organisation's own deployments, or to act as inspiration. The OWASP code portion of the AppSensor Project, that aims to build a reference implementation for concepts conveyed in the guide, is described in chapters 20 and 21.

Each chapter describes the source of the implementation, provides a schematic arrangement, defines which types of detection points and responses are possible, the location of source code, and details of any considerations and related implementations. There is no single implementation method or single best-suited out-the-box solution, since the approach is application-specific.

Previous and subsequent posts describe the other parts of the new guide.

Posted on: 09 May 2014 at 11:57 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

More Entries

Monitoring : Application Security and Privacy
ISO/IEC 18004:2006 QR code for https://clerkendweller.uk

Page https://www.clerkendweller.uk/monitoring
Requested by on Friday, 27 March 2015 at 11:58 hrs (London date/time)

Please read our terms of use and obtain professional advice before undertaking any actions based on the opinions, suggestions and generic guidance presented here. Your organisation's situation will be unique and all practices and controls need to be assessed with consideration of your own business context.

Terms of use https://www.clerkendweller.uk/page/terms
Privacy statement https://www.clerkendweller.uk/page/privacy
© 2008-2015 clerkendweller.uk