Stories from the Security Operations Center (S.O.C.)

1. Thank you.

2. STORIES FROM THE
SECURITY OPERATIONS
CENTER (S.O.C.)
Paul Fletcher
Cyber Security Evangelist, Alert Logic

3. Complexity of defending web applications and workloads
Web App
Attacks
OWASP
Top 10
Platform /
Library
Attacks
System /
Network
Attacks

5. Popular Web Application Attacks
Source: blog.sucuri.net

6. Recent SQL Injection Vulnerabilities

7. Today’s Attacks Have Several Stages

8. Initial Attack:
Word Press
XMLRPC Attack

9. Initial Attack: Word Press XMLRPC Attack
Athletic Apparel Shop Brick & Mortar and e-commerce
Application stack Custom code written in XML
Word Press content management system
MySQL database
Detection method Intrusion Detection System (IDS)
Log collection and analysis
Web Application Firewall (WAF)

10. Word Press XMLRPC Attack

11. Word Press XMLRPC Attack

12. Word Press XMLRPC Attack

13. Mitigating WP XMLRPC Attacks

14. Mitigating WP XMLRPC Attacks

15. Mitigating WP XMLRPC Attacks

16. Exfiltration:
SQL Injection

17. Exfiltration: SQL Injection Attack

18. SQL Injection Attack

19. SQL Injection Attack

20. What do you see?
Attack:
Response:

21. SQL Injection Attack

22. Impact of Web App Attacks – Key Takeaways
• Web Apps are becoming more prevalent in organizations
- Use of open source versus traditional applications
• Web App attacks are “gateway” attacks
- Yahoo breach started with a Word Press hack
- 9,000 C&C servers compromised by Word Press hack
- Shadow IT
• Early Stage Detection
- Prevents our customers from dealing with large scale breaches

23. How Alert Logic Detects Threats

24. Thank You.