This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Category:OWASP Logging Project"

From OWASP
Jump to: navigation, search
Line 2: Line 2:
  
 
The OWASP Logging Project [[:Category:OWASP Logging Project - Roadmap|Roadmap]]  
 
The OWASP Logging Project [[:Category:OWASP Logging Project - Roadmap|Roadmap]]  
 +
 +
[[Image:IBWAS09_OWASP_Logging_Project_Presentation.ppt]]<br>
  
 
[[Image:Owasp_Logging_Project_Roadmap.pdf]]<br>  
 
[[Image:Owasp_Logging_Project_Roadmap.pdf]]<br>  

Revision as of 22:52, 13 December 2009

Main

The OWASP Logging Project Roadmap

File:IBWAS09 OWASP Logging Project Presentation.ppt

File:Owasp Logging Project Roadmap.pdf

File:OWASP Logging Guide.pdf

Goals

eventlog-mgt.jpg


Provide tools for software developers in order to help them define and provide meaningful logs

Provide code audit tools to ensure that log messages are consistent and complete (content, format, timestamps)

Facilitate the integration of logs from different sources

Facilitate attack reconstruction

Facilitate information sharing around security events

Existing tools and use cases


1) IDE integration (auto-completion, templates, logging policy definition support) for guiding software developers to define and provide meaningful logs

For example, a template can provide checks/hints/defaults s.a. those defined by the OWASP Enterprise Security API :
- something equivalent to a generated logging session ID, or a hashed value of the session ID so they can track session specific events without risking the exposure of a live session's ID
- identity of the user that caused the event
- description of the event (supplied by the caller)
- whether the event succeeded or failed (indicated by the caller)
- severity level of the event (indicated by the caller)
- that this is a security relevant event (indicated by the caller)
- hostname or IP where the event occurred (and ideally the user's source IP as well)
- a time stamp


IDE templates

http://www.owasp.org/index.php/File:Eclipse_Create_Template.png

http://www.owasp.org/index.php/File:NetBeans_Create_Live_Template.png

http://wiki.netbeans.org/Java_EditorUsersGuide


OWASP ESAPI Logger interface (Logger.java) and implementations
http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API
http://code.google.com/p/owasp-esapi-java/downloads/list


2/ Code audit tools s.a. OWASP yasca can be easily adapted in order to ensure that logging standards are respected and that log messages are consistent and complete (content, format, timestamps)
See http://www.owasp.org/index.php/Category:OWASP_Yasca_Project
Related OWASP projects: http://www.owasp.org/index.php/Category:OWASP_Orizon_Project


3) Integrating application logs into a Security Information Management configuration
OSSIM (http://www.ossim.net/) has numerous plugins for parsing webserver, appserver, WAF, IPS, IDS logs and generating/storing events in its standard format.

Adding a plugin for parsing custom application logs is as easy as finding the correct regular expression provided that developers included all relevant information in the log message and that they have done so in a consistent way.

You can refer to the OSSIM database model to see what data is stored for events.

See http://www.owasp.org/index.php/File:OWASP_Logging_Guide.pdf for more details/screenshots on application event integration and correlation via OSSIM


4) Reconstructing attacks
It is difficult to analyze, filter and generally reconstruct an attack because messages are spread around various log levels.

See the Logging part of the OWASP ESAPI project
http://code.google.com/p/owasp-esapi-java/downloads/list

Along the same lines, Arshan Dabirsiaghi's proposal of adding a security log level is very interesting
http://www.owasp.org/index.php/How_to_add_a_security_log_level_in_log4j


5) Implement scripts for filtering/scrubbing logs in order to enable log data sharing between organizations
Goal: information sharing around security events
Custom logger implementations based on the OWASP ESAPI might also filter out any sensitive data specific to the current application or organization, such as credit cards, social security numbers etc.

See the Logging part of the OWASP ESAPI project
See http://code.google.com/p/owasp-esapi-java/downloads/list






         *** We need your efforts and contribution to this project ***



Feedback and Participation:

We hope you find the OWASP Logging Project useful. Please contribute to the Project by volunteering for one of the Tasks, sending your comments, questions, and suggestions. To join the OWASP Logging Project mailing list or view the archives, please visit the subscription page.



Project Identification


PROJECT INFO
What does this OWASP project offer you?
RELEASE(S) INFO
What does this OWASP project release offer you?
what is this project?
OWASP Logging Project

Purpose: The goals of this project are:

  • Provide tools for software developers in order to help them define and provide meaningful logs
  • Provide code audit tools to ensure that log messages are consistent and complete (content, format, timestamps)
  • Facilitate the integration of logs from different sources
  • Facilitate attack reconstruction
  • Facilitate information sharing around security events

License: N/A

who is working on this project?
Project Leader: Marc Chisinevski

Project Maintainer: Marc Chisinevski

Project Contributor(s):

how can you learn more?
Project Pamphlet: N/A

3x slide Project Presentation: N/A

Mailing list: Subscribe or read the archives

Project Roadmap: To view, click here

Main links: N/A

Project Health: Yellow button.JPG Not Reviewed (Provisional)
To be reviewed under Assessment Criteria v2.0

Key Contacts
  • Contact Marc Chisinevski to contribute, review or sponsor this project
  • Contact the GPC to report a problem or concern about this project or to update information.
current release
First Release - Unknown Date - (no download available)

Release Leader: N/A

Release details: N/A :

Rating: Yellow button.JPG Not Reviewed
To be reviewed under Assessment Criteria v2.0


Pages in category "OWASP Logging Project"

The following 2 pages are in this category, out of 2 total.