AppSensor ResponseActions - Revision history

Clerkendweller: /* ASR-H: Function Amended */ Example extended

2014-03-25T12:57:42Z

‎ASR-H: Function Amended: Example extended

Clerkendweller: Examples added/updated

2014-03-25T11:09:27Z

Examples added/updated

Clerkendweller: /* ASR-M: Collect Data from User */ Phone example added

2013-06-04T15:04:56Z

‎ASR-M: Collect Data from User: Phone example added

Clerkendweller: /* Intrusive */ BeEF example added

2013-05-19T14:14:47Z

‎Intrusive: BeEF example added

Clerkendweller: /* ASR-K: Account Lockout */ IP blocking consideration added

2013-05-19T08:49:43Z

‎ASR-K: Account Lockout: IP blocking consideration added

Clerkendweller: Updated linked file size and inline table image

2011-08-03T11:59:13Z

Updated linked file size and inline table image

Clerkendweller: /* Overview */ Refertence to no response added, and next available letter example changed to "Q"

2011-08-02T16:25:56Z

‎Overview: Refertence to no response added, and next available letter example changed to "Q"

Clerkendweller: Added P = No Response

2011-08-02T16:23:50Z

Added P = No Response

Clerkendweller: /* ASR-H: Function Amended */ Additional anti-automation example added - token bucket mentioned

2010-10-08T11:52:25Z

‎ASR-H: Function Amended: Additional anti-automation example added - token bucket mentioned

Clerkendweller: /* ASR-M: Collect Data from User */ Additional consideration text with links to examples of methods

2010-10-05T21:00:41Z

‎ASR-M: Collect Data from User: Additional consideration text with links to examples of methods

@@ Line 473: / Line 473: @@
 Example 8: Additional human interactive proof challenges added due to the number of incorrect guesses of CAPTCHAs outnumbering the correct guesses by more than a certain factor (e.g. [http://research.microsoft.com/pubs/74609/CCS2007.pdf Token bucket] idea)
-Example 9: Fuzz responses to mask real functionality or increase attacker efforts to enumerate the application (e.g. random URL generation using [http://sourceforge.net/p/adhd/wiki/Home/ ADHD Spider Trap] or [https://code.google.com/p/weblabyrinth/ Weblabyrinth])
+Example 9: Fuzz responses to mask real functionality or increase attacker efforts to enumerate the application (e.g. random URL generation using [http://sourceforge.net/p/adhd/wiki/Home/ ADHD Spider Trap] or [https://code.google.com/p/weblabyrinth/ Weblabyrinth], realistic but invalid cipher text data using techniques such as [http://www.technologyreview.com/news/523746/honey-encryption-will-bamboozle-attackers-with-fake-secrets/ honey encryption])
 </td></tr>
 <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >code</td>

@@ Line 326: / Line 326: @@
 Example 3: Message sent by email to the registered email address to inform them their password has been changed
 </td></tr>
 <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >code</td>
@@ Line 470: / Line 472: @@
 Example 8: Additional human interactive proof challenges added due to the number of incorrect guesses of CAPTCHAs outnumbering the correct guesses by more than a certain factor (e.g. [http://research.microsoft.com/pubs/74609/CCS2007.pdf Token bucket] idea)
 </td></tr>
 <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >code</td>
@@ Line 514: / Line 518: @@
 Example 4: Prevent new site registrations
-Example 5: Web service inactivated
+Example 5: Web service inactivated or cloaked
 Example 6: Content syndication stopped

@@ Line 693: / Line 693: @@
 Example 3: Deploy JavaScript to collect information about the user's network
 </td></tr>
 <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >code</td>

@@ Line 675: / Line 675: @@
 <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >consideration</td>
 <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
-This response is meant to be non-malicious in intent - it is simply additional information gathering - and not retaliatory or damaging to the user, their systems or data, nor make any permanent change.  An alert user might be aware of the action.  Be very wary of data collected and perform appropriate validation and sanitization.  Ensure any use of this type of response is legally permissible in the relevant jurisdictions, and complies with the application's terms of use, privacy notice and corporate policies.
+This response is meant to be non-malicious in intent - it is simply additional information gathering - and not retaliatory or damaging to the user, their systems or data, nor make any permanent change.  An alert user might be aware of the action.  Be very wary of data collected and perform appropriate validation and sanitization.  Ensure any use of this type of response is legally permissible in the relevant jurisdictions, and complies with corporate policies and the application's terms of use, privacy notice and corporate policies.
 To a certain extent, any additional payload in a response might cause a user's browser or computer to crash, and this might have unforeseen circumstances.
@@ Line 683: / Line 683: @@
 * [http://www.modsecurity.org/projects/modsecurity/apache/feature_content_injection.html Response content injection] using JavaScript to discover the user's real IP address
 * [http://decloak.net/ Embeddable decloaking engine] to discover the real IP address of a web user
 </td></tr>

@@ Line 590: / Line 590: @@
 <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >consideration</td>
 <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
+If IP blocking is implemented, it is recommended this is undertaken at the network layer using the operating system (e.g. iptables, Windows firewall) or by a network device (e.g. firewall).
 </td></tr>
 <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >examples</td>

← Older revision		Revision as of 11:59, 3 August 2011
Line 20:		Line 20:


−	A text version of the table, with some examples and alternative classifications, is described in [http://www.owasp.org/index.php/File:Owasp-appsensor-responses.pdf AppSensor - Response Actions] (66 KB PDF). The information on the page below is likely to be more up-to-date.	+	A text version of the table, with some examples and alternative classifications, is described in [http://www.owasp.org/index.php/File:Owasp-appsensor-responses.pdf AppSensor - Response Actions] (63 KB PDF). The information on the page below is likely to be more up-to-date.

	=Detailed Listing=		=Detailed Listing=

@@ Line 7: / Line 7: @@
 =Overview=
-The following table lists possible AppSensor Responses (ASRs).  The application response actions are categorized here from the user's perspective (not from the application/server's perspective):
+The following table lists possible AppSensor Responses (ASRs), other than no response (ASR-P).  The application response actions are categorized here from the user's perspective (not from the application/server's perspective):
 * Silent: User(s) unaware of any application change
@@ Line 14: / Line 14: @@
 * Intrusive: Non-malicious action on user's system
-''To add a response action, just use the next available letter (e.g. "ASR-O") - they don't have to be in alphabetical order below, but place it in the appropriate category (silent, passive, active or intrusive).  The image in the table below can be updated later to keep in step with the page content.''
+''To add a response action, just use the next available letter (e.g. "ASR-Q") - they don't have to be in alphabetical order below, but place it in the appropriate category (silent, passive, active or intrusive).  The image in the table below can be updated later to keep in step with the page content.''
@@ Line 21: / Line 21: @@
 A text version of the table, with some examples and alternative classifications, is described in [http://www.owasp.org/index.php/File:Owasp-appsensor-responses.pdf AppSensor - Response Actions] (66 KB PDF).  The information on the page below is likely to be more up-to-date.
 =Detailed Listing=

← Older revision		Revision as of 16:23, 2 August 2011
Line 33:		Line 33:

	==Silent==		==Silent==
		+
		+	===ASR-P: No Response===
		+
		+	<table style="border-style:double;border-width:3px;" >
		+	<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >id</td>
		+	<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
		+	ASR-P
		+	</td></tr>
		+	<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >title</td>
		+	<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
		+	No Response
		+	</td></tr>
		+	<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >classifications</td>
		+	<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
		+	(not applicable)
		+	</td></tr>
		+	<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >category</td>
		+	<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
		+	Silent
		+	</td></tr>
		+	<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >description</td>
		+	<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
		+	There is no response. This could be used to record in logs that a detection event did not lead to any particular response action.
		+	</td></tr>
		+	<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >consideration</td>
		+	<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
		+
		+	</td></tr>
		+	<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >examples</td>
		+	<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
		+	Example 1: A detection point fired, but the threshold for response has not been reached
		+	</td></tr>
		+	<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >code</td>
		+	<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
		+	-
		+	</td></tr>
		+	</table>

	===ASR-A: Logging Change===		===ASR-A: Logging Change===

@@ Line 423: / Line 423: @@
 Example 2: Reduce number of times/day the user can submit a review
-Example 3: Additional registration validation steps
+Example 3: Additional registration identity validation steps
 Example 4: Additional anti-automation measures (e.g. out-of-band verification activated, CAPTCHA introduced)
@@ Line 432: / Line 432: @@
 Example 7: Watermarks added to pages, images and other content
 </td></tr>
 <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >code</td>