This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "AppSensor ResponseActions"
From OWASP
(→ASR-B: Administrator Notification: Add tables for responses C-M) |
(→Silent: Classifications added...) |
||
| Line 129: | Line 129: | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >classifications</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >classifications</td> | ||
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | ||
| − | + | Logging and notifying | One user | Instantaneous | |
</td></tr> | </td></tr> | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >category</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >category</td> | ||
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | ||
| − | + | Silent | |
</td></tr> | </td></tr> | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >description</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >description</td> | ||
| Line 172: | Line 172: | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >classifications</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >classifications</td> | ||
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | ||
| − | + | Logging | One user | For a period | |
</td></tr> | </td></tr> | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >category</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >category</td> | ||
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | ||
| − | + | Passive | |
</td></tr> | </td></tr> | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >description</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >description</td> | ||
| Line 215: | Line 215: | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >classifications</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >classifications</td> | ||
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | ||
| − | + | Logging, notifying and disrupting | One user | Instantaneous | |
</td></tr> | </td></tr> | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >category</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >category</td> | ||
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | ||
| − | + | Passive | |
</td></tr> | </td></tr> | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >description</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >description</td> | ||
| Line 258: | Line 258: | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >classifications</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >classifications</td> | ||
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | ||
| − | + | Logging and disrupting | One, some or all users | Instantaneous (request) or for a period | |
</td></tr> | </td></tr> | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >category</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >category</td> | ||
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | ||
| − | + | Passive | |
</td></tr> | </td></tr> | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >description</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >description</td> | ||
| Line 301: | Line 301: | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >classifications</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >classifications</td> | ||
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | ||
| − | + | Logging, notifying (sometimes) and disrupting | One user | Instantaneous | |
</td></tr> | </td></tr> | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >category</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >category</td> | ||
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | ||
| − | + | Active | |
</td></tr> | </td></tr> | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >description</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >description</td> | ||
| Line 344: | Line 344: | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >classifications</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >classifications</td> | ||
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | ||
| − | + | Logging, notifying (sometimes), disrupting and blocking | One, some or all users | For a period or permanent | |
</td></tr> | </td></tr> | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >category</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >category</td> | ||
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | ||
| − | + | Active | |
</td></tr> | </td></tr> | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >description</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >description</td> | ||
| Line 388: | Line 388: | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >classifications</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >classifications</td> | ||
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | ||
| − | + | Logging, notifying (sometimes), disrupting and blocking | One, some or all users | For a period or permanent | |
</td></tr> | </td></tr> | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >category</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >category</td> | ||
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | ||
| − | + | Active | |
</td></tr> | </td></tr> | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >description</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >description</td> | ||
| Line 431: | Line 431: | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >classifications</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >classifications</td> | ||
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | ||
| − | + | Logging, notifying (sometimes), disrupting and blocking | One user | Instantaneous | |
</td></tr> | </td></tr> | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >category</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >category</td> | ||
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | ||
| − | + | Active | |
</td></tr> | </td></tr> | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >description</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >description</td> | ||
| Line 474: | Line 474: | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >classifications</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >classifications</td> | ||
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | ||
| − | + | Logging, notifying (sometimes), disrupting and blocking | One user | For a period or permanent | |
</td></tr> | </td></tr> | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >category</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >category</td> | ||
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | ||
| − | + | Active | |
</td></tr> | </td></tr> | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >description</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >description</td> | ||
| Line 517: | Line 517: | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >classifications</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >classifications</td> | ||
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | ||
| − | + | Logging, notifying (sometimes), disrupting and blocking | All users | Permanent | |
</td></tr> | </td></tr> | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >category</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >category</td> | ||
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | ||
| − | + | Active | |
</td></tr> | </td></tr> | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >description</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >description</td> | ||
| Line 560: | Line 560: | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >classifications</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >classifications</td> | ||
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | ||
| − | + | Logging | One user | For a period | |
</td></tr> | </td></tr> | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >category</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >category</td> | ||
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" > | ||
| − | + | Intrusive | |
</td></tr> | </td></tr> | ||
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >description</td> | <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >description</td> | ||
Revision as of 13:48, 20 September 2010
About This Document
These response actions are part of the OWASP AppSensor project which advocates bringing intelligent intrusion detection inside the application. These responses can be used to counter a malicious user that has been detected probing for vulnerabilities or weaknesses within your application.
THIS PAGE IS STILL IN PROGRESS
- 1 About This Document
- 2 Overview
- 3 Detailed Listing
- 3.1 Silent
- 3.1.1 ASR-A: Logging Change
- 3.1.2 ASR-B: Administrator Notification
- 3.1.3 ASR-C: Other Notification
- 3.1.4 ASR-D: User Status Change
- 3.1.5 ASR-E: User Notification
- 3.1.6 ASR-F: Timing Change
- 3.1.7 ASR-G: Process Terminated
- 3.1.8 ASR-H: Function Amended
- 3.1.9 ASR-I: Function Disabled
- 3.1.10 ASR-J: Account Logout
- 3.1.11 ASR-K: Account Lockout
- 3.1.12 ASR-L: Application Disabled
- 3.1.13 ASR-M: Collect Data from User
- 3.2 Passive
- 3.3 Active
- 3.1 Silent
Overview
The following table lists possible AppSensor Responses (ASRs). The application response actions are categorized here by:
- Silent: User(s) unaware of any application change
- Passive: Process altered, but user(s) may still continue to process completion
- Active: Functionality reduced or disabled
A text version of the table, with examples and alternative classifications, is described in AppSensor - Response Actions (64 KB PDF).
Detailed Listing
Classifications are:
- Purposes: Logging, Notifying, Disrupting and Blocking
- Target: One, Some or All users
- Response duration: Instantaneous (e.g. just for the request), Period (e.g. time period or session duration), Permanent
Silent
ASR-A: Logging Change
| id |
ASR-A |
| title |
Logging Change |
| classifications |
Logging | One, some or all users | Instantaneous (request) or for a period |
| category |
Silent |
| description |
The granularity of logging is changed (typically more logging). |
| consideration | |
| examples |
Example 1: Capture sanitised request headers and response bodies Example 2: Full stack trace of error messages logged Example 3: Record DNS data on user's IP address Example 4: Security logging level changed to include 'informational' messages |
| code |
- |
ASR-B: Administrator Notification
| id |
ASR-B |
| title |
Administrator Notification |
| classifications |
Logging and notifying | One, some or all users | Instantaneous |
| category |
Silent |
| description |
A notification message is sent to the application administrator(s) |
| consideration | |
| examples |
Example 1: Email alert sent to everyone in the administration team Example 2: SMS alert sent to the on-call administrator Example 3: Visual indicator displayed on an application monitoring dashboard Example 4: Audible alarm in the control room |
| code |
- |
ASR-C: Other Notification
| id |
ASR-C |
| title |
Other Notification |
| classifications |
Logging and notifying | One user | Instantaneous |
| category |
Silent |
| description | |
| consideration | |
| examples |
Example 1: Example 2: Example 3: Example 4: |
| code |
- |
ASR-D: User Status Change
| id |
ASR-D |
| title |
User Status Change |
| classifications |
Logging | One user | For a period |
| category |
Passive |
| description | |
| consideration | |
| examples |
Example 1: Example 2: Example 3: Example 4: |
| code |
- |
ASR-E: User Notification
| id |
ASR-E |
| title |
User Notification |
| classifications |
Logging, notifying and disrupting | One user | Instantaneous |
| category |
Passive |
| description | |
| consideration | |
| examples |
Example 1: Example 2: Example 3: Example 4: |
| code |
- |
ASR-F: Timing Change
| id |
ASR-F |
| title |
Timing Change |
| classifications |
Logging and disrupting | One, some or all users | Instantaneous (request) or for a period |
| category |
Passive |
| description | |
| consideration | |
| examples |
Example 1: Example 2: Example 3: Example 4: |
| code |
- |
ASR-G: Process Terminated
| id |
ASR-G |
| title |
Process Terminated |
| classifications |
Logging, notifying (sometimes) and disrupting | One user | Instantaneous |
| category |
Active |
| description | |
| consideration | |
| examples |
Example 1: Example 2: Example 3: Example 4: |
| code |
- |
ASR-H: Function Amended
| id |
ASR-H |
| title |
Function Amended |
| classifications |
Logging, notifying (sometimes), disrupting and blocking | One, some or all users | For a period or permanent |
| category |
Active |
| description | |
| consideration | |
| examples |
Example 1: Example 2: Example 3: Example 4: |
| code |
- |
ASR-I: Function Disabled
| id |
ASR-I |
| title |
Function Disabled |
| classifications |
Logging, notifying (sometimes), disrupting and blocking | One, some or all users | For a period or permanent |
| category |
Active |
| description | |
| consideration | |
| examples |
Example 1: Example 2: Example 3: Example 4: |
| code |
- |
ASR-J: Account Logout
| id |
ASR-J |
| title |
Account Logout |
| classifications |
Logging, notifying (sometimes), disrupting and blocking | One user | Instantaneous |
| category |
Active |
| description | |
| consideration | |
| examples |
Example 1: Example 2: Example 3: Example 4: |
| code |
- |
ASR-K: Account Lockout
| id |
ASR-K |
| title |
Account Lockout |
| classifications |
Logging, notifying (sometimes), disrupting and blocking | One user | For a period or permanent |
| category |
Active |
| description | |
| consideration | |
| examples |
Example 1: Example 2: Example 3: Example 4: |
| code |
- |
ASR-L: Application Disabled
| id |
ASR-L |
| title |
Application Disabled |
| classifications |
Logging, notifying (sometimes), disrupting and blocking | All users | Permanent |
| category |
Active |
| description | |
| consideration | |
| examples |
Example 1: Example 2: Example 3: Example 4: |
| code |
- |
ASR-M: Collect Data from User
| id |
ASR-M |
| title |
Collect Data from User |
| classifications |
Logging | One user | For a period |
| category |
Intrusive |
| description | |
| consideration | |
| examples |
Example 1: Example 2: Example 3: Example 4: |
| code |
- |
