The Dark Side of Monitoring
•Transferir como PPTX, PDF•
0 gostou•317 visualizações
We all use monitoring - after all, we all want to ensure that our applications are working as expected. But can hackers use it to exploit our application? Join me to explore different ways to exploit application monitoring tools, and what mitigations we can use.
Recomendados
Recomendados
Mais conteúdo relacionado
Semelhante a The Dark Side of Monitoring
Semelhante a The Dark Side of Monitoring (9)
Mais de Soluto
Mais de Soluto (20)
Último
Último (20)
The Dark Side of Monitoring
- 1. @omerlh The Dark Side of Monitoring Omer Levi Hevroni May 2019
- 3. @omerlh Can Hackers Use It Too?
- 7. @omerlh Threat Modeling? ● What are we building? ● What can go wrong? ● What are we doing about it? ● Did we do a good job?
- 9. @omerlh
- 10. @omerlh
- 14. @omerlh Threat Modeling ● What are we building? ● What can go wrong? ● What are we doing about it? ● Did we do a good job?
- 15. @omerlh White-box Monitoring Monitoring based on metrics exposed by the internals of the system, including logs, interfaces like the Java Virtual Machine Profiling Interface, or an HTTP handler that emits internal statistics.
- 16. @omerlh White-box Monitoring for Kubernetes ● Probes (liveness/readiness) ● Prometheus
- 17. @omerlh Probes
- 18. @omerlh What are we building?
- 19. @omerlh Probes
- 20. @omerlh Why? ●Check dependencies ○ Databases ○ Other micro-services ●Kill services if it misfunction before users experience it
- 22. @omerlh What Can go wrong?
- 23. @omerlh Exploiting liveness - information disclosure
- 24. @omerlh Exploiting liveness – Denial of Service
- 25. @omerlh
- 26. @omerlh What are we doing about it?
- 28. @omerlh Caching Source code - Kamus
- 30. @omerlh What are we building?
- 31. @omerlh Prometheus ● Monitoring system ● Time-Series database ● Alerting system ● Auto-discovery https://prometheus.io/
- 33. @omerlh What Can go wrong?
- 34. @omerlh Exploiting Prometheus - information disclosure
- 35. @omerlh
- 37. @omerlh What about this metric?
- 38. @omerlh Here is the code behind it…
- 39. @omerlh What Can We Do About It?
- 41. @omerlh Prometheus Metrics Limit https://www.omerlh.info/2019/03/04/keeping-prometheus-in-shape/
- 42. @omerlh Did we do a good job?
- 43. @omerlh Threat Modeling ● What are we building? ● What can go wrong? ● What are we doing about it? ● Did we do a good job?
- 46. @omerlh What are we building?
- 47. @omerlh Black-box Monitoring Testing externally visible behavior as a user would see it.
- 49. @omerlh What Can go wrong?
- 50. @omerlh STRIDE S – Spoofing T – Tampering R – Repudiation I – Information Disclosure D – Denial of Service E – Elevation of Privileges
- 51. @omerlh Spoofing
- 55. @omerlh What are we doing about it?
- 56. @omerlh Potential Mitigations ● Least Privilege ● Block access ● Tracing ● Limit to test data only
- 57. @omerlh Did we do a good job?
- 59. @omerlh Can Hackers Use It Too?
- 60. @omerlh Key Take Away ● Monitoring is just code ● Careful when exposed to the internet ● Use cache when possible ● Conduct threat model for black-box monitoring
- 63. @omerlh Thank You! Omer Levi Hevroni April 2019