1. OWASP AppSensor Michael Coates AppSensor Aspect Security
Nov 5, 2008

2. AppSensor – Summer of Code 2008 Beta Quality Release Reviewers:
Introduction
AppSensor – Summer of Code 2008
Beta Quality Release
Reviewers:
Eric Sheridan
Randy Janinda
42 Detection Points
42 Pages

3. Applications Today

4. Introduce AppSensor

5. Why?
Logging
Passive
Too Late
WAF
Generic
No Business Context

6. Detection

7. Trend Detection

8. Respond per Established Policy
Response
Eliminate Threat
Respond per Established Policy
3 Suspicious Events = 1 Security Event
1 Attack Event = 1 Security Event
User events totals cleared on rolling 24 hrs basis
Suspicious Event: Username contains ‘; could just be a typo as the user was trying to hit enter
Attack Event: URL submitted with parameter containing 1=1—’

9. Detection Integrated into Code
Implementation
Detection Integrated into Code
Aspect (Filters), Code Level Exception
ESAPI
Response Access to User Object

10. Download AppSensor Beta Contact Me
Future Plans
ESAPI Swing Set Demo
Open Source Case Study
Handling Scanners
“On the web”
Download AppSensor Beta
Contact Me