Stories from the Security Operations Center (S.O.C.)
0 likes•300 views
The document discusses recent web application attacks and how they are detected and mitigated. It describes a WordPress XMLRPC attack on an athletic apparel shop's website as an initial attack vector. This attack allowed the exploitation of a SQL injection vulnerability for data exfiltration. The document emphasizes that web applications are increasingly prevalent targets and that early detection of attacks is important to prevent large-scale breaches. It concludes by explaining how Alert Logic detects threats through intrusion detection, log analysis, and web application firewalls.
Stories from the Security Operations Center (S.O.C.)
- 1. Thank you.
- 2. STORIES FROM THE SECURITY OPERATIONS CENTER (S.O.C.) Paul Fletcher Cyber Security Evangelist, Alert Logic
- 3. Complexity of defending web applications and workloads Web App Attacks OWASP Top 10 Platform / Library Attacks System / Network Attacks
- 5. Popular Web Application Attacks Source: blog.sucuri.net
- 6. Recent SQL Injection Vulnerabilities
- 7. Today’s Attacks Have Several Stages
- 8. Initial Attack: Word Press XMLRPC Attack
- 9. Initial Attack: Word Press XMLRPC Attack Athletic Apparel Shop Brick & Mortar and e-commerce Application stack Custom code written in XML Word Press content management system MySQL database Detection method Intrusion Detection System (IDS) Log collection and analysis Web Application Firewall (WAF)
- 10. Word Press XMLRPC Attack
- 11. Word Press XMLRPC Attack
- 12. Word Press XMLRPC Attack
- 13. Mitigating WP XMLRPC Attacks
- 14. Mitigating WP XMLRPC Attacks
- 15. Mitigating WP XMLRPC Attacks
- 17. Exfiltration: SQL Injection Attack
- 20. What do you see? Attack: Response:
- 22. Impact of Web App Attacks – Key Takeaways • Web Apps are becoming more prevalent in organizations - Use of open source versus traditional applications • Web App attacks are “gateway” attacks - Yahoo breach started with a Word Press hack - 9,000 C&C servers compromised by Word Press hack - Shadow IT • Early Stage Detection - Prevents our customers from dealing with large scale breaches
- 23. How Alert Logic Detects Threats
- 24. Thank You.