Lesson 6.4: Logging, monitoring and rate limiting
Attacks you can't see, you can't stop. What a web application should log (security events with time, user and address, never passwords or tokens), what OWASP A09 means by logging and monitoring failures, how to spot password spraying in an application log, and how rate limiting slows guessing down. In the lab you read the shop's security log, find one address that tried one login on each of 25 accounts, notice that successful logins aren't logged at all, then add a per-address rate limit for the login page in nginx and prove it answers 429 after a few attempts.
19 min
You will learn to
- Name the security events an application should log
- Explain OWASP A09 and why missing logs hurt investigations
- Recognise password spraying in an application log
- Add a per-address rate limit in nginx
- Explain alerting and log protection
Key terms
- Security event
- Something worth recording for security: logins (failed and successful), logouts, password and e-mail changes, permission denials, input validation failures, admin actions.
- Logging and monitoring failures
- OWASP A09: events not logged, logs not watched, no alerts, logs kept too briefly or only on the attacked machine.
- Password spraying
- Trying one or a few common passwords against many accounts, slowly, to avoid lockouts.
- Rate limiting
- Limiting how many requests a client may make in a period.
- SIEM
- Security Information and Event Management: a system that collects logs from many sources, correlates them and raises alerts.
- WAF
- A filter in front of a web application that blocks requests matching attack patterns.
← Troubleshooting a network, layer by layer · All lessons · Protecting personal data: GDPR and data protection laws worldwide →