Mitigating OWASP Web Application Risk: Security Logging & Monitoring Failures using F5 XC Platform

Fig 1: Logs collected by regular text format makes difficult to extract any observations and to take decisions from it.

From the above logs it is tedious to categorise requests based on type and their severity and hence it is difficult to identify the attacks or anomalies from it.

There is no point in logging the requests and not presenting them in easily understandable GUI format which helps security teams to detect and respond to the security events, if any.

Professional and comprehensive Solution:

A Web application should always have capability of logging events such as,

1. User logins 
2. Warning and error messages 
3. Appropriate alerting threshold  
4. Attack Detection

F5 XC stores log requests as mentioned above along with its detailed information. F5 XC categorizes the logs based on different dimensions of its characteristics and displays them in GUI template according to Customer needs which helps them to understand better about their behaviour. This elaborative way of logging and displaying logs makes it easier for forensic analysis and investigation.

Security Monitoring Dashboard gives an integrated view of overall primary essence of attack details for a given time stamp. Below is the information that can be extracted from the above dashboard picture.

• Displays security events by their type and top attacked sites from respective source IP’s along with geographical location as well.
• Top attack types by their signatures ID give detailed view on attacker’s approach to violate the application behaviour.

Traffic is processed by aggregating for better understanding on categories such as Malicious Users, Security Events, DDoS tabs etc, as mentioned above. This provides critical intelligence of application security at your fingertips.

Filtering enables the security team to easy debug and identify the issues. It helps in narrowing down to identify the abnormal behaviour based on multiple parameters like country, URL, region etc.

Fig 3: Filtering helps in identifying suspicious traffic using required parameters during debugging or investigating issues.

F5 XC enhances the alerts with additional information for the customers to make decisions faster.