31 July 2015


Posts relating to the category tag "monitoring" are listed below.

17 December 2014

Business Failure at the Speed of Software

This week we saw two events where the automated nature of processes lead to major business failures.

Partial extract from the RepricerExpress showing some of the liability clauses in its terms and conditions of service published at http://www.repricerexpress.com/terms-and-conditions/

On Friday, a number of Amazon retailers were affected by a pricing problem. Those that had chosen to subscribe to the third-party RepricerExpress service that automatically adjusts prices to match or better competitors, found their products were being sold for as little as 1 pence. Those organisations that despatched their own goods were able to spot the problem themselves, but those that used Amazon to stock and ship product, were affected more seriously because Amazon simply carried on regardless for some time.

The cause of the hour-long issue has been fixed. RepricerExpress's clients are outraged, and of course for some of them this could put them out of business. I am sure RepricerExpress will be reminding its clients what they agreed to in the RepricerExpress end user licence agreement (partial screenshot in the image above). Including for example that the maximum liability "shall be limited to a sum equal to the total Licence Fees paid to the Licensor in the period of 12 months considered retrospectively from the date the cause of action arose". So, how much would you pay for something that can reduce your product prices by almost 100%? £20-70 per month apparently seems to be the answer.

Express indeed.

Then on Monday, taxi-like company Uber, which had another PR disaster last month, managed to incense everyone by rapidly escalating its prices in Sydney as "demand increased" i.e. people attempted to leave the city during the dreadful cafe hostage event. Later reacting to pressure, Uber cancelled the change and offered some free services instead and a refund to those affected by its pricing.

These have a common factor of automated software making unmoderated changes to pricing that would clearly be perceived as unreasonable to a human. And doing it fast.

Superfast fail.

Automation is good — but enumerate all the possibilities, and implement limits, checks and alerts. And monitor these. And more importantly, check your contracts and who is liable for what. Then do a risk assessment and make sure someone senior reviews this and makes some decision about the risks. Can you survive the unexpected?

Posted on: 17 December 2014 at 17:23 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

20 November 2014

TRUSTe Privacy Deception and Misrepresentation

US regulator Federal Trade Commission (FTC) has taken to task self-appointed privacy certifier TRUSTe (True Ultimate Standards Everywhere, Inc.) which labels itself as "powering trust and compliance".

Partial screen capture of a page from the TRUSTe web site showing some of its web privacy certification products

In a press release issued this week, the FTC states that TRUSTe has agreed to settle charges that it "deceived consumers about its recertification program for company's privacy practices, as well as perpetuated its misrepresentation as a non-profit entity".

Apart from a $200,000 fine, the proposed extensive settlement requires "TRUSTe will be prohibited from making misrepresentations about its certification process or timeline, as well as being barred from misrepresenting its corporate status or whether an entity participates in its program. In addition, TRUSTe must not provide other companies or entities the means to make misrepresentations about these facts, such as through incorrect or inaccurate model language.".

TRUSTe CEO Chris Babel's comment about the settlement can be found on the TRUSTe blog.

The United Kingdom TRUSTe web site is http://www.truste.co.uk/ which lists many UK clients. Sadly, a Google search indicates many of their clients haven't realised what's been going on and are still promoting the label.

Posted on: 20 November 2014 at 14:15 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

25 July 2014

Creative Content UK Alert Programme

An industry-led initiative will replace plans for the UK government's Digital Economy Act (DEA) copyright regime.

BT, Sky, Virgin and TalkTalk have committed to sending out up to four warning letters to each customer a year if their accounts have been identified as being used to breach copyright laws

The plans, announced just over a week ago, primarily relate to P2P file sharing of music, TV and movies, but may be of use to other content producers. Read the Virgin Media's blog post from and the press release from trade body BPI.

There is an in depth write-up on the Out-Law.com legal news site, and further comment here and also here.

Posted on: 25 July 2014 at 14:00 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

13 June 2014

Characterising Fraudulent Online Customers

Payment processor 2Checkout has launched a new quarterly report detailing payment fraud trends.

Partial view of one of the charts from 2Checkout Fraud Index 2014Q1

2Checkout Fraud Index 2014 Quarter 1 contains information from the company's own checkout and payment fraud monitoring systems, cross tabulated against other observed buyer characteristics.

The report includes data on and ranks buyer fraud by:

  • Credit card issuer
  • Billing address
  • IP address
  • Currency
  • Cross border status
  • Product type
  • Value of transaction.

Any prior national prejudices might be challenged. Useful stuff if your are running your own online fraud monitoring system and setting thresholds for potential fraud alerts.

Posted on: 13 June 2014 at 09:35 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

10 May 2014

AppSensor Guide Part VI: Reference Materials

This post describes Part VI, the final part, of the new OWASP AppSensor Guide v2.0, published on 2nd May.

Photograph of a street barrier with a notice stating 'Caution - Traffic management Trial - Do Not Move'

"Part VI: Reference Materials" comprises seven sections:

  • Glossary
  • Detection Points
  • Responses
  • Data Signaling Exchange Formats
  • Awareness and Training Resources
  • Feedback and Testimonials
  • References.

Part VI includes the primary information sources including all the lists and details about detection point types and the response types. This part therefore includes a quarter of the 40 tables and 51 figures included in the guide.

Updates to these and further reference materials are maintained on the OWASP AppSensor Project website.

Previous posts describe the other parts of the new guide.

Posted on: 10 May 2014 at 12:12 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

09 May 2014

AppSensor Guide Part V : Model Dashboards

This post describes what is in Part V of the new OWASP AppSensor Guide v2.0, published on 2nd May.

Photograph of a technician lying on the ground in the middle of a street behind a barrier, working on a display sign

"Part V : Model Dashboards" comprises three shorter chapters:

  • Chapter 27 : Security Event Management Tools
  • Chapter 28 : Application-Specific Dashboards
  • Chapter 29 : Application Vulnerability Tracking.

Part V introduces the necessary concepts for visualising AppSensor data, and presents example application-specific dashboards that have already been created.

Data visualisation of real-time attack detection and response provides organisations with much needed insight into whether their applications are under attack, and by whom.

Previous and a subsequent post describe the other parts of the new guide.

Posted on: 09 May 2014 at 15:19 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

09 May 2014

AppSensor Guide Part IV : Demonstration Implementations

This post describes what is in Part IV of the new OWASP AppSensor Guide v2.0, published on 2nd May.

Photograph of a wooden gate to a field, with a sign 'Beware of Bull' on it, with verdant green grass and coniferous trees behind

"Part IV : Demonstration Implementations" comprising seven chapters, each three pages long, describes model implementations:

  • Chapter 20 : Web Services (AppSensor WS)
  • Chapter 21 : Fully Integrated (AppSensor Core)
  • Chapter 22 : Light Touch Retrofit
  • Chapter 23 : Ensnare for Ruby
  • Chapter 24 : Invocation of AppSensor Code Using Jni4Net
  • Chapter 25 : Using an External Log Management System
  • Chapter 26 : Leveraging a Web Application Firewall.

Part IV provides practical examples of how the AppSensor concept can be deployed, including some standalone components that could be utilised within an organisation's own deployments, or to act as inspiration. The OWASP code portion of the AppSensor Project, that aims to build a reference implementation for concepts conveyed in the guide, is described in chapters 20 and 21.

Each chapter describes the source of the implementation, provides a schematic arrangement, defines which types of detection points and responses are possible, the location of source code, and details of any considerations and related implementations. There is no single implementation method or single best-suited out-the-box solution, since the approach is application-specific.

Previous and subsequent posts describe the other parts of the new guide.

Posted on: 09 May 2014 at 11:57 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

08 May 2014

AppSensor Guide Part III : Making It Happen

This post describes what is in Part III of the new OWASP AppSensor Guide v2.0, published on 2nd May.

Photograph of a construction materials compound surrounded by a wire fence with a red and white reflective warning stripe along it

"Part III : Making It Happen" comprising seven chapters, is the largest part of the guide except for the reference materials:

  • Chapter 13 : Introduction
  • Chapter 14 : Design and Implementation
  • Chapter 15 : Verification, Deployment and Operation
  • Chapter 16 : Advanced Detection Points
  • Chapter 17 : Advanced Thresholds and Responses
  • Chapter 18 : AppSensor and Application Event Logging
  • Chapter 19 : AppSensor and PCI DSS for Ecommerce Merchants.

Part III describes the process of planning, implementing and operating application-specific attack detection and response. The process described is technology agnostic and attempts to be descriptive rather than prescriptive, providing awareness, a description of the problem set, an outline of different approaches at a higher level and some generic approaches.

A description is provided of how to integrate AppSensor concepts into the software development lifecycle (SDLC), and includes mappings to the Open Software Assurance Maturity Model (Open SAMM), the Building Security In Maturity Model (BSIMM), the BITS Financial Services Roundtable Software Assurance Framework, and the Microsoft Security Development Lifecycle (MS SDL). Chapters 17 and 18 provide further information for those wishing to delve deeper into the selection and definition of detection points, attack determination thresholds and responses.

The guide shows how success using AppSensor concepts comes down to many details, and how the process suggested in Part III should be adapted to an organisation's own culture, its working practices and its risks.

Previous and subsequent posts describe the other parts of the new guide.

Posted on: 08 May 2014 at 13:12 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

08 May 2014

AppSensor Guide Part II : Illustrative Case Studies

This post describes what is in Part II of the new OWASP AppSensor Guide v2.0, published on 2nd May.

Photograph of a sign that reads 'Keep Out' in large white letters on a blue background

"Part II : Illustrative Case Studies" comprises eight chapters, each 1-2 pages long:

  • Chapter 5 : Case Study of a Rapidly Deployed Web Application
  • Chapter 6 : Case Study of a Magazine's Mobile App
  • Chapter 7 : Case Study of a Smart Grid Consumer Meter
  • Chapter 8 : Case Study of a Financial Market Trading System
  • Chapter 9 : Case Study of a B2C Ecommerce Website
  • Chapter 10 : Case Study of B2B Web Services
  • Chapter 11 : Case Study of a Document Management System
  • Chapter 12 : Case Study of a Credit Union's Online Banking.

Part II demonstrates how AppSensor can be used for a range of different software application architectures and business risk. They span market sectors, and application types including web sites, web services, mobile apps, critical infrastructure, and client-server.

Each case study demonstrates how business objectives influence the selection of detection points and responses. They show how there is no one single AppSensor solution applicable to all applications and organisations.

Previous and subsequent posts describe the other parts of the new guide.

Posted on: 08 May 2014 at 07:35 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

07 May 2014

AppSensor Guide Part I : AppSensor Overview

This post describes what is in Part I of the new OWASP AppSensor Guide v2.0, published on 2nd May.

Photograph of a sign on some security fencing that reads 'Warning - commit a crime here and you will be forensically tagged'

"Part I : AppSensor Overview" comprises four chapters spanning almost 30 pages of content:

  • Chapter 1 : Application-Specific Attack Detection & Response
  • Chapter 2 : Protection Measures.
  • Chapter 3 : The AppSensor Approach
  • Chapter 4 : Conceptual Elements.

Part I gives a high-level overview of the concept. It also details why it is different to traditional defensive techniques. This is then followed by a description of the general approach towards implementing AppSensor within application software projects.

It describes how the OWASP AppSensor Project defines a conceptual framework, methodology, guidance and example code to implement attack detection and automated responses. It is not a bolt-on tool or code library, but instead offers insight to an approach for organisations to specify or develop their own implementations - specific to their own business, applications, environments and risk profile - building upon existing standard security controls.

Subsequent posts describe the other parts of the new guide.

Posted on: 07 May 2014 at 17:21 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

More Entries

Monitoring : Application Security and Privacy
ISO/IEC 18004:2006 QR code for https://clerkendweller.uk

Requested by on Friday, 27 November 2015 at 18:57 hrs (London date/time)

Please read our terms of use and obtain professional advice before undertaking any actions based on the opinions, suggestions and generic guidance presented here. Your organisation's situation will be unique and all practices and controls need to be assessed with consideration of your own business context.

Terms of use https://www.clerkendweller.uk/page/terms
Privacy statement https://www.clerkendweller.uk/page/privacy
© 2008-2015 clerkendweller.uk