Dev Training

# Dev Training
### Insufficient Logging and Monitoring

## Logging and monitoring

### Why?

* Lack of logging and monitoring is the bedrock of most incidents
* Adversaries exploit the situation to stay undetected during attack
    * Probing and testing
    * Exploitation
    * Exfiltration

### Purpose of logs

* Audit trail
* Incident prevention and detection (with monitoring)
* Incident investigation (if incident occurs)

## Where to log

### Keep logs separate

* If application is compromised, it should be hard to temper with logs to hide evidence
* Try to separate logs from applications as much as possible
    * Centralized log collector
* Log in a standard format to facilitate integration with centralized log collector

## What to log

### Probing indicators

* Input validation failures
* Output validation failures
* Authentication failures
* Access control violations
* Application errors
* Session management failures

### Auditing

* Authentication success
* Use of high risk functionality
    * Network requests
    * Subprocess calls
    * Webhooks
    * Password change/reset
    * File uploads
* Actions performed by privileged users
    * Adding/deleting users, tokens

### Attributes

* When
    * Date and time
* Where
    * Name of service/module/file
    * Action being performed
* Who
    * User ID, user IP
* What
    * Event type and severity
    * Description

## What not to log

### Personally Identifiable Data

* ID numbers (kennitölur)
* Sensitive personal data
    * Medical information
    * Other sensitive data, as defined by GDPR

### Sensitive application data

* Session tokens
* Access tokens
* Users' passwords
* Application credentials

### Dumping

* Be careful about creating generic "catch-all" logging methods that dump data blindly into logs
    * HTTP headers
    * Form data
    * Cookies
* This can lead to sensitive data being unintentionally added to logs

## Epilogue

### Further reading

* [OWASP - Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html)
* [OWASP - Implement Security Logging and Monitoring](https://owasp.org/www-project-proactive-controls/v3/en/c9-security-logging.html)

### Hall of fame

* In 2016, identifying a breach took [an average of 191 days](https://www.ibm.com/downloads/cas/ZYKLN2E3)
* [SolarWinds](https://thehackernews.com/2021/01/heres-how-solarwinds-hackers-stayed.html) attackers avoided detection for more than a year
* [RU attack in 2021](https://www.ru.is/haskolinn/frettir/frettir-af-tolvuaras-a-hr): Attackers were undetected for at least 2 months
    * No logs existed for initial breach