Insufficient Logging and Monitoring

Overview

The importance of securing a website cannot be understated. While 100% security is not a realistic goal, there are ways to keep your website monitored on a regular basis so you can take immediate action when something happens. Not having an efficient logging and monitoring process in place can increase the damage of a website compromise. Here at Sucuri, we highly recommend that every website is properly monitored. If you need to monitor your server, OSSEC is freely available to help you. OSSEC actively monitors all aspects of system activity with file integrity monitoring, log monitoring, root check, and process monitoring.

Description

Insufficient logging and monitoring is a common issue that can greatly impact the security of a website. Without a proper logging and monitoring process in place, it becomes difficult to detect and respond to security incidents in a timely manner. Attackers can exploit vulnerabilities and go undetected for long periods of time, causing significant damage to the website and potentially compromising sensitive data. It is essential for website owners to prioritize logging and monitoring as part of their overall security strategy.

How to Prevent ?

To have efficient website monitoring, it is important to implement proper logging and monitoring practices. Keeping audit logs is vital in detecting suspicious changes to the website. An audit log records events and helps in identifying anomalies, allowing website owners to confirm if an account has been compromised. Regularly updating software and applications is also crucial to protect against known vulnerabilities. Virtual patching can be used as an alternative when immediate patching is not possible. Sucuri and OWASP recommend virtual patching to provide protection against known vulnerabilities even without the latest patches. Additionally, utilizing security plugins and tools designed specifically for website monitoring can assist in managing and detecting security threats.

Example Attack Scenarios:

• Open-source project forum software compromise:  In a scenario where an open-source project forum software was hacked due to a flaw in its software, insufficient logging and monitoring exacerbated the breach. The attackers were able to wipe out the internal source code repository and all forum contents. The project suffered severe consequences, and the lack of monitoring, logging, or alerting contributed to the extent of the breach.

• Credential scanning for common passwords:  Attackers can scan for users with common passwords and take over accounts using these passwords. The scan may leave behind only one false login for other users. This attack method can result in widespread account compromise if proper monitoring is not in place.

• Failure to respond to malware detection:  In a case reported by a major U.S. retailer, the internal malware analysis sandbox had been producing warnings of potentially unwanted software for some time. However, no action was taken, and the breach was only detected after fraudulent card transactions occurred. This failure to respond to detection highlights the importance of active monitoring and alerting.