Welcome to sufficient logging and monitoring session.
In this first part, we will focus on threat analysis. We
will first discuss what insufficient logging and monitoring is
and then how the system can be harmed, the impact of
successful exploitation, and give you some insights to
identify who may want to harm your system insufficient
logging and monitoring is the Bedrock of nearly every
major incident allowing attackers activity to pass a
notice in 2016, identifying
a bridge to Canaveral job, 191 days,
plenty of time for damage to
Inflicted and we are not doing better and
2019. This number grew to two hundred
and six days plus 7 to 3 days, average to contain
a bridge. We are talking about two hundred
seventy nine days. Total. You should
consider that any of the other owasp top
10 risks in the sociated. Vulnerabilities, may be used
as attack. Vectors attackers. Do not exploit insufficient
logging and monitoring directly. They go after other
vulnerabilities and application may have, and take advantage of
each of His official logging and monitoring to pass unnoticed in
make their attack last longer until your organization is
capable of mitigated improper
logging and monitoring leads to longer incident response
times. Preventing organizations to react in a timely fashion.
When the logs do not include sufficient details
along the organization to understand the attackers activity extent.
Then there's a loss of accountability, the
losses are obvious and they have been reported in
the news behind the damage caused by attackers it.
50 organizations may also be subject of fines
according to applicable, law and regulations.
Malicious actors did not exploit directly sufficient logging
in monitoring, but it makes their activities and noticed
or at least harder to detect and track anyone
to whom your systems date, is valuable me Target
your application to get an authorized access or even controlling
the system, reviewing the threat analysis, part of
previous sessions may help. You identifying who may want
to harm your system. You should think about it, broadly depending
on your systems nature. Foreign nations may
be a threat agent, on the other hand. You have a non-toxic
Get specific threat agents looking for ransom employees
and contractors terrorists in the activists and
organized crime. You'll find this table
in the last top 10. Pause the video, and take your time to
carefully, read it in the next part. We will
demonstrate how attackers take advantage of insufficient logging and
monitoring while perpetrating a credential stuffing attack on
our Target application.