OWASP Logging Project - Presentation at IBWAS09

•

0 likes•404 views

MarcChisinevski

Objectives of this presentation ,[object Object],[object Object],[object Object],[object Object],[object Object]

Goals of the OWASP Logging Project ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

1) Provide tools for software developers in order to help them define and provide meaningful logs ,[object Object],[object Object],[object Object],[object Object]

IDE (Integrated Development Environment) Templates can provide checks/hints/defaults. Examples defined by the OWASP Enterprise Security API: - hashed value of the session ID, identity of the user that caused the event, description of the event (supplied by the caller) - whether the event succeeded or failed (indicated by the caller), severity level of the event (indicated by the caller) - that this is a security relevant event (indicated by the caller) - hostname or IP where the event occurred (and ideally the user's source IP as well), a time stamp

2) Provide code audit tools to ensure that log messages are consistent and complete ,[object Object],[object Object],[object Object]

3) Integrating application logs into a Security Information Management configuration ,[object Object],[object Object],[object Object],[object Object]

[object Object],[object Object],[object Object]

Current problems ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Current problems ,[object Object],[object Object]

Live Demo 1 - Ossim ,[object Object],[object Object]

Current day details from the previous Executive Dashboard: very technical information, clearly not useful for CFO/CEOs, with all due respect

Functional benefits of a multidimensional solution ,[object Object],[object Object],[object Object]

Functional benefits of the multidimensional solution ,[object Object],[object Object],[object Object]

Technical benefits of the multidimensional solution ,[object Object],[object Object],[object Object]

Live Demo 2 - Multidimensional solution ,[object Object]

Acknowledgments ,[object Object],[object Object]

What's hot

Recent Cybersecurity Concerns and How to Protect SCADA/HMI Applications Prese...AVEVA

Application Security Guide for Beginners Checkmarx

iSecurity Visualizer Business Intelligence DemoRaz-Lee Security

Beginner's Guide to SIEM AlienVault

dos_security_finalMichele Vincent

cloud Resilience Integral university, India

How to Simplify Audit Compliance with Unified Security ManagementAlienVault

Simplify PCI DSS Compliance with AlienVault USMAlienVault

Creating Correlation Rules in AlienVaultAlienVault

Improve Security Visibility with AlienVault USM Correlation DirectivesAlienVault

What is SIEMPatten John

IDS for Security Analysts: How to Get Actionable Insights from your IDSAlienVault

Amarjeet_Updated_ResumeAmarjeet Kumar

Resume_Santoro_Aug_2016David A. Santoro

Intelligence driven SOC as a Servicerver21

Devasis Kumar Mahato - ResumeDevasis Kumar

8-step Guide to Administering Windows without Domain Admin PrivilegesBeyondTrust

Open Source IDS Tools: A Beginner's GuideAlienVault

SIEM 101: Get a Clue About IT Security Analysis AlienVault

How to Solve Your Top IT Security Reporting Challenges with AlienVaultAlienVault

What's hot (20)

Recent Cybersecurity Concerns and How to Protect SCADA/HMI Applications Prese...

Application Security Guide for Beginners

iSecurity Visualizer Business Intelligence Demo

Beginner's Guide to SIEM

dos_security_final

cloud Resilience

How to Simplify Audit Compliance with Unified Security Management

Simplify PCI DSS Compliance with AlienVault USM

Creating Correlation Rules in AlienVault

Improve Security Visibility with AlienVault USM Correlation Directives

What is SIEM

IDS for Security Analysts: How to Get Actionable Insights from your IDS

Amarjeet_Updated_Resume

Resume_Santoro_Aug_2016

Intelligence driven SOC as a Service

Devasis Kumar Mahato - Resume

8-step Guide to Administering Windows without Domain Admin Privileges

Open Source IDS Tools: A Beginner's Guide

SIEM 101: Get a Clue About IT Security Analysis

How to Solve Your Top IT Security Reporting Challenges with AlienVault

Similar to OWASP Logging Project - Presentation at IBWAS09

Dot Net performance monitoringKranthi Paidi

SAD REPORTING GROUP 2BCFGGGGHHHJJJJ.pptxJakeariesMacarayo

Note This project is broken up into Windows and Mac version.pdfsagaraccura

This project is broken up into Windows and Mac versions lis.pdfadinathfashion1

This project is broken up into Windows and Mac versions lis.pdfableelectronics

CODE-RELATED-ARTIFACTS-CPAR.powerpoint.artsJessicaJacinto7

Spring Boot & Spring Cloud Apps on Pivotal Application Service - Daniel LavoieVMware Tanzu

Stu r36 bSelectedPresentations

SpringOne Tour Denver - Spring Boot & Spring Cloud on Pivotal Application Ser...VMware Tanzu

3830100.pptazida3

Data to Insight in a Flash: Introduction to Real-Time Analytics with WSO2 Com...WSO2

Designing for Privacy in AWS cloudKrzysztof Kąkol

Custom Software Development Checklist by Michael Cordovahoolikar77

FeasibleSayan Mandal

BrownResearch_CVAbby Brown

SEIM-Microsoft Sentinel.pptxAmrMousa51

Internet of ThingsDeZyre

Infocyte - Digital Forensics and Incident Response (DFIR) Training SessionInfocyte

Securing your web applications a pragmatic approachAntonio Parata

What is going on? Application Diagnostics on Azure - Copenhagen .NET User GroupMaarten Balliauw

OWASP Logging Project - Presentation at IBWAS09

1. OWASP Logging Project Presentation by Marc Chisinevski

5. IDE (Integrated Development Environment) Templates can provide checks/hints/defaults. Examples defined by the OWASP Enterprise Security API: - hashed value of the session ID, identity of the user that caused the event, description of the event (supplied by the caller) - whether the event succeeded or failed (indicated by the caller), severity level of the event (indicated by the caller) - that this is a security relevant event (indicated by the caller) - hostname or IP where the event occurred (and ideally the user's source IP as well), a time stamp

10.

11.

12. OSSIM executive dashboard

13. Current day details from the previous Executive Dashboard: very technical information, clearly not useful for CFO/CEOs, with all due respect

14.

15.

16.

17.

18. Essbase outlines

19. Essbase outlines

20. Demo data feed

21.