Stories from the Security Operations Center

1. STORIES FROM THE
SECURITY OPERATIONS
CENTER (S.O.C.)
Paul Fletcher
Cyber Security Evangelist, Alert Logic

2. Complexity of defending web applications and workloads
Web App
Attacks
OWASP
Top 10
Platform /
Library
Attacks
System /
Network
Attacks

3. Network Topology

4. Popular Web Application Attacks
Source: blog.sucuri.net

5. Recent SQL Injection Vulnerabilities

6. Today’s Attacks Have Several Stages

7. Initial Attack:
Word Press
XMLRPC Attack

8. Initial Attack: Word Press XMLRPC Attack
Athletic Apparel Shop Brick & Mortar and e-commerce
Application stack Custom code written in XML
Word Press content management system
MySQL database
Detection method Intrusion Detection System (IDS)
Log collection and analysis
Web Application Firewall (WAF)

9. Word Press XMLRPC Attack

10. Word Press XMLRPC Attack

11. Word Press XMLRPC Attack

12. Mitigating WP XMLRPC Attacks

13. Mitigating WP XMLRPC Attacks

14. Mitigating WP XMLRPC Attacks

15. Exfiltration:
SQL Injection

16. Exfiltration: SQL Injection Attack

17. SQL Injection Attack

18. SQL Injection Attack

19. What do you see?
Attack:
Response:

20. SQL Injection Attack

21. Impact of Web App Attacks – Key Takeaways
• Web Apps are becoming more prevalent in organizations
- Use of open source versus traditional applications
• Web App attacks are “gateway” attacks
- Yahoo breach started with a Word Press hack
- 9,000 C&C servers compromised by Word Press hack
- Shadow IT
• Early Stage Detection
- Prevents our customers from dealing with large scale breaches

22. How Alert Logic Detects Threats

23. Thank You.