Top 10-2017 A10-Insufficient Logging&Monitoring - Revision history

T.Gigler: Editorial changes e.g. line feeds, added a link

2018-01-01T17:15:33Z

Editorial changes e.g. line feeds, added a link

T.Gigler: Added line feed at Scenario #1 .. #3

2017-12-14T22:54:40Z

Added line feed at Scenario #1 .. #3

T.Gigler: Prepare OWASP Top 10-2017 Release (Content)

2017-12-14T22:51:21Z

Prepare OWASP Top 10-2017 Release (Content)

T.Gigler: Updated Navigation (incl PrevLink and NextLink)

2017-12-12T00:37:34Z

Updated Navigation (incl PrevLink and NextLink)

T.Gigler: 1st dummy page

2017-12-11T23:32:15Z

1st dummy page

New page

{{Top_10_2013:TopTemplate
|usenext=2013NextLink
|next={{Top_10:LanguageFile|text=whatsNextforDevelopers|year=2017|language=en}}
|useprev=2013PrevLink
|prev=A9-{{Top_10_2010:ByTheNumbers
|9
|year=2017
|language=en}}
|year=2017
|language=en
}}

{{Top_10_2013:BottomAdvancedTemplate
|type={{Top_10_2010:StyleTemplate}}
|usenext=2013NextLink
|next={{Top_10:LanguageFile|text=whatsNextforDevelopers|year=2017|language=en}}
|useprev=2013PrevLink
|prev=A9-{{Top_10_2010:ByTheNumbers
|9
|year=2017
|language=en}}
|year=2017
|language=en
}}

@@ Line 17: / Line 17: @@
      <td colspan=2 {{Template:Top_10_2010:SummaryTableRowStyleTemplate|year=2017}}>
 <!--- Threat Agent: --->
-Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident. Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected. </td>
+Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.<br/>Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected. </td>
      <td colspan=2  {{Template:Top_10_2010:SummaryTableRowStyleTemplate|year=2017}}>
 <!--- Security Weakness: --->
-  This issue is included in the Top 10 based on an <u>[https://owasp.blogspot.com/2017/08/owasp-top-10-2017-project-update.html industry survey]</u>. One strategy for determining if you have sufficient monitoring is to examine the logs following penetration testing. The testers' actions should be recorded sufficiently to understand what damages they may have inflicted. </td>
+  This issue is included in the Top 10 based on an <u>[https://owasp.blogspot.com/2017/08/owasp-top-10-2017-project-update.html industry survey]</u>.<br/>One strategy for determining if you have sufficient monitoring is to examine the logs following penetration testing. The testers' actions should be recorded sufficiently to understand what damages they may have inflicted. </td>
      <td colspan=2  {{Template:Top_10_2010:SummaryTableRowStyleTemplate|year=2017}}>
 <!--- Impacts: --->
-  Most successful attacks start with vulnerability probing. Allowing such probes to continue can raise the likelihood of successful exploit to nearly 100%. In 2016, identifying a breach took an <u>[https://www-01.ibm.com/common/ssi/cgi-bin/ssialias?htmlfid=SEL03130WWEN& average of 191 days]</u> – plenty of time for damage to be inflicted. </td>
+  Most successful attacks start with vulnerability probing. Allowing such probes to continue can raise the likelihood of successful exploit to nearly 100%.<br/>In 2016, identifying a breach took an <u>[https://www-01.ibm.com/common/ssi/cgi-bin/ssialias?htmlfid=SEL03130WWEN& average of 191 days]</u> – plenty of time for damage to be inflicted. </td>
 {{Top_10_2010:SummaryTableEndTemplate|year=2017}}
@@ Line 36: / Line 36: @@
 * Penetration testing and scans by <u>[[:Category:Vulnerability_Scanning_Tools|DAST]]</u> tools (such as <u>[[OWASP_Zed_Attack_Proxy_Project|OWASP ZAP]]</u>) do not trigger alerts.
 * The application is unable to detect, escalate, or alert for active attacks in real time or near real time.
-You are vulnerable to information leakage if you make logging and alerting events visible to a user or an attacker (see A3:2017-Sensitive Information Exposure).
+You are vulnerable to information leakage if you make logging and alerting events visible to a user or an attacker (see <b><u>[[{{Top_10:LanguageFile|text=documentRootTop10New|language=en|year=2017 }}_A3-{{Top_10_2010:ByTheNumbers|3|year=2017|language=en}} | A3:2017-{{Top_10_2010:ByTheNumbers|3|year=2017|language=en}}]]</u></b>).
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=howToPrevent|position=right|year=2017|language=en}}

@@ Line 49: / Line 49: @@
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=exampleScenarios|position=left|year=2017|language=en}}
 <b>Scenario #1</b>: An open source project forum software run by a small team was hacked using a flaw in its software. The attackers managed to wipe out the internal source code repository containing the next version, and all of the forum contents. Although source could be recovered, the lack of monitoring, logging or alerting led to a far worse breach. The forum software project is no longer active as a result of this issue.
 <b>Scenario #2</b>: An attacker uses scans for users using a common password. They can take over all accounts using this password. For all other users, this scan leaves only one false login behind. After some days, this may be repeated with a different password.
 <b>Scenario #3</b>: A major US retailer reportedly had an internal malware analysis sandbox analyzing attachments. The sandbox software had detected potentially unwanted software, but no one responded to this detection. The sandbox had been producing warnings for some time before the breach was detected due to fraudulent card transactions by an external bank.

@@ Line 1: / Line 1: @@
 {{Top_10_2013:TopTemplate
-     |usenext=2013NextLink
+     |usenext=2017NextLink
      |next={{Top_10:LanguageFile|text=whatsNextforDevelopers|year=2017|language=en}}
-     |useprev=2013PrevLink
+     |useprev=2017PrevLink
      |prev=A9-{{Top_10_2010:ByTheNumbers
                |9
@@ Line 14: / Line 14: @@
 {{Top_10_2013:BottomAdvancedTemplate
      |type={{Top_10_2010:StyleTemplate}}
-     |usenext=2013NextLink
+     |usenext=2017NextLink
      |next={{Top_10:LanguageFile|text=whatsNextforDevelopers|year=2017|language=en}}
-     |useprev=2013PrevLink
+     |useprev=2017PrevLink
      |prev=A9-{{Top_10_2010:ByTheNumbers
                |9