Splunk for Web Application Security...Splunk for Web Application Security Kyle Barry Kyle Barry...

Splunk for Web Application Security

Kyle Barry

Kyle BarrySecurity Engineering Manager

@allofmywats

The world’s handmade marketplace

30 million members

$895 million in GMS

30% of transactions are international

1.4 billion page views a month

Security at Etsy

sharpwriter.etsy.com

Vulnerabilities

• Cross Site Scripting (XSS)

• Persistent vs. Non-persistent

Vulnerabilities

• SQL Injection (SQLi)

Vulnerabilities

• SQL Injection (SQLi)

• Authentication Bypass

• Account Takeover

• Phishing

• Account Takeover

• Phishing

• Scams

Getting it Done

40+ Daily Deploys

5 Minutes to Production

Config Flags

Continuous Integration

Splunk?

Phishing Attackkaroart.etsy.com

An Attack in 4 Parts

Step 1: Alerting

Alerting

• Cron Job?

Alerting

• Cron Job?

• Offline Processing?

Alerting

• Cron Job?

• Real Time?

Alerting

• Cron Job?

• Real Time?

• Splunk

High Number of Logins from a Single IP

Alerting

• Info Log

[Wed Apr 22 16:37:41 2013] [MF9JqDVpY93VOMreyvI2UC24wRjT] [info][login] status="success" user="kbarry" ip="123.321.123.321"

• Splunk Search

source="/data/current/web/info.log" action="login" | transaction ip | sort -eventcount | table ip eventcount

Step 2: Damage Control

Damage Control

• Find Affected Accounts

• The Old Way*

awk -F'[ "]+' '$7 == "/" { ipcount[$1]++ } END { for (i in ipcount) { printf "%15s - %d\n", i, ipcount[i] } }' logfile.log

• Splunk Search

* : The old way courtesy of http://serverfault.com/questions/11028

Step 3: Look for Trends

Step 4: Clean Up

Clean Up

• Find Affected Accounts

• The Old Way*

awk -F'[ "]+' '$7 == "/" { ipcount[$1]++ } END { for (i in ipcount) { printf "%15s - %d\n", i, ipcount[i] } }' logfile.log

• Splunk Search

* : The old way courtesy of http://serverfault.com/questions/11028

Putting it Together

Security Mechanisms

Incident Response

Ad-hoc analysis of a large dataset

Driven by an event or incident

Needs to be fast

Reactive Security

Real-time event monitoring and alerting

Events that trigger immediate response

You always query the same data and you do it often

Proactive Security

Things we do now to protect us later

Actions taken to prevent future compromise

Incident Response

wildlifeprints.etsy.com

Phishing Attack

Scanners

Reactive Security

Alerting

• Failed Logins (Info Log)

[Wed Apr 22 16:37:41 2013] [MF9JqDVpY93VOMreyvI2UC24wRjT] [info][login] failed login user:"kbarry" ip:"123.321.123.321"

• Splunk Search

source="/data/current/web/info.log" log_namespace="login" | transaction user | sort -eventcount | table user eventcount

source="/data/current/web/info.log" log_namespace="login" | transaction ip | sort -eventcount | table ip eventcount

Alerting

• XSS Alert

source="/data/syslog/current/web/access.log" | regex request_uri="(%3Cscript%3E|alert\(|onerror)"

• SQLi Alert

source="/data/syslog/current/web/info.log" "database syntax error at"

Proactive Security

wildlifeprints.etsy.com

Full-site SSL for all Etsy sellers

Full Site SSL

• Which pages are important?

source="/data/syslog/current/web/access.log" is_seller=1 | transaction request_uri | table request_uri is_ssl

• How much traffic?

[insert query here]

Security Dashboards

Splunk Friendly Application

Make Logging Easy

$data = array('user' => 'kbarry', 'ip' => 123.321.123.321);

Logger::info('failed captcha', $data,'login');

Make Splunking Easy

Access Log[Wed Apr 22 16:37:41 2013] "POST /signin HTTP/1.1" 200 "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.57 Safari/536.11" MF9JqDVpY93VOMreyvI2UC24wRjT

Info Log

[Wed Apr 22 16:37:41 2013] [MF9JqDVpY93VOMreyvI2UC24wRjT] [info] [login] failed captcha user:"kbarry" ip:"123.321.123.321"

Global Request ID

Access Log[Wed Apr 22 16:37:41 2013] "POST /signin HTTP/1.1" 200 "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.57 Safari/536.11" MF9JqDVpY93VOMreyvI2UC24wRjT

Info Log

[Wed Apr 22 16:37:41 2013] [MF9JqDVpY93VOMreyvI2UC24wRjT] [info] [login] failed captcha user:"kbarry" ip:"123.321.123.321"

• The More You Know (TM)

• Security is a Real Time Problem

• The More You Know (TM)

• Security is a Real Time Problem

• Instrument your Application Appropriately

Splunk for Web Application Security...Splunk for Web Application Security Kyle Barry Kyle Barry...

Documents

stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

Security use cases using splunk · SECURITY USE CASES USING SPLUNK | Security Use Cases with Splunk This article focuses on security use cases that can be created and managed within

Splunk Inc. Splunk 4.1.7 Security Target - Common Criteria · 1.1 ST Reference ... 7.1.3.2 FDP_ACF.1 Access control functions ... ST Title: Splunk Inc. Splunk 4.1.7 Security Target

Cloud & DevOps Program...Splunk App Administration for Enterprise Security 3.1 (Virtual) Searching & Reporting: Splunk 6 (Virtual) Advanced Searching & Reporting: Splunk 6 (Virtual)

Referent / Redner Benjamin Tiggemann · 2015-07-08 · Splunk for Exchange Splunk for Enterprise Security* Splunk for Vmware Splunk for PCI Compliance* Splunk for Windows Splunk for

Forensic Investigator Splunk App - SplunkConf Investigator Splunk App 2600 2800 2900 Downloads Later Tony Lee | Sr. Technical Director @Cylance –“Splunk Guy” Kyle Champlin |

Qualys Data + Splunk Security Analytics = Finding Hidden ... · © 2018 splunk inc. © 2017 splunk inc. confidential information. do not distribute

SplunkLive Brisbane Splunk for Operational Security Intelligence

Zscaler and Splunk for Security · Splunk Enterprise, Enterprise Security (ES) and Splunk User Behavior Analytics (UBA) use ingested data to identify and raise security events, combines

Splunk for Security - UnderDefense · Splunk acts as the security nerve center for small and big companies. Splunk’s security platform gives organizations the ability to detect,

Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

Splunk for Security: Background & Customer Case Study

ENHANCE AWS SECURITY WITH SPLUNK® SOLUTIONS

Security use cases using splunk - InfoSec Resources - IT ...resources.infosecinstitute.com/.../Security-Use-Cases-using-Splunk.pdf · SECURITY USE CASES USING SPLUNK | Other Use Cases

APT Detection mit Splunk - Compass Security · APT DETECTioN miT SPLUNk Die Compass Security entwickelt und betreibt ein weltwei-tes Security Labor mit den Namen Hacking-Lab. Das

Splunk Security: Detecting Unknown Malware and Ransomwarenetworkdatahub.com/assets/wp/Splunk-Security-Detecting-Unknown-… · falling victim to malware attacks. This paper will take

Splunk Enterpise for Information Security Hands-On

Splunk SOC Automation Challenges - Rapid7 · Splunk SOC Automation Challenges Splunk™ is a powerful log management solution and is increasingly used by security teams for SIEM (Security

Splunk App: Windows Security Operation Center

Conf2014 FredWilmot Splunk Security (2)