7 ms·

What tends to be the first indication of breaches? It's one thing to do a forensic analysis after learning of a breach, and it's another to detect it in the fir

What tends to be the first indication of breaches? It's one thing to do a forensic analysis after learning of a breach, and it's another to detect it in the first place.

bigiain 7y ago
Mostly, Troy Hunt e-mailing clueless companies saying "Hey, this data breach I got sent seems to check out as real, at least a few of the users in it have validated that's currently or recently been their $company website credential to me." (Only mostly joking...)
nerdbaggy 7y ago
I worked at a company that logged every single SQL query and made a rule set based on that. May not of been the most efficient but it worked great. There was basically a whitelist of sorts and if the query structure wasn’t in there then action taken. Also worked by knowing what queries came in what order when doing certain things.
- xfitm3 7y ago
  What tooling did you use to audit queries?
  - dboreham 7y ago
    Not parent but it reads like they wrote their own (presumably driven by DB server log data with query logging enabled).
- INTPenis 7y ago
  This sounds a lot like an IDS for SQL. I've worked with government agencies that focus very heavily on IDS in firewall systems. SO not only do they catch attacks early, in the perimiter network, but they also often block legitimate traffic and handle such cases regularly. But it's a default deny policy so that comes with. It also costs a ton of money for the best IDS solutions. I believe it comes from companies like Checkpoint, Cisco and Symantec.
clebio 7y ago
It depends on attack surface and what tooling you already have in place. But for example: > Finding suspicious outbound network activity https://blog.rapid7.com/2016/05/09/introduction-to-osquery-for-threat-detection-dfir/ https://blog.rapid7.com/2016/05/09/introduction-to-osquery-f...
wepple 7y ago
I’ve done a few small IR jobs in my time, and also have a hobby of reading every breach report that comes out. It seems the vast majority of breach discovery amongst typical companies is an engineer going “hrmm that’s odd”: a router at 100% CPU because it’s currently part of a DDoS attack. A DBA noticing a huge query they don’t recall running. Unusual login times for administrative accounts. Having email systems sinkholed for sending spam. And of course “all my files are encrypted?”

What tends to be the first indication of breaches? It's one thing to do a forensic analysis after learning of a breach, and it's another to detect it in the first place.

bigiain 7y ago

Mostly, Troy Hunt e-mailing clueless companies saying "Hey, this data breach I got sent seems to check out as real, at least a few of the users in it have validated that's currently or recently been their $company website credential to me." (Only mostly joking...)

nerdbaggy 7y ago

I worked at a company that logged every single SQL query and made a rule set based on that. May not of been the most efficient but it worked great. There was basically a whitelist of sorts and if the query structure wasn’t in there then action taken. Also worked by knowing what queries came in what order when doing certain things.

xfitm3 7y ago
What tooling did you use to audit queries?
- dboreham 7y ago
  Not parent but it reads like they wrote their own (presumably driven by DB server log data with query logging enabled).
INTPenis 7y ago
This sounds a lot like an IDS for SQL. I've worked with government agencies that focus very heavily on IDS in firewall systems. SO not only do they catch attacks early, in the perimiter network, but they also often block legitimate traffic and handle such cases regularly. But it's a default deny policy so that comes with. It also costs a ton of money for the best IDS solutions. I believe it comes from companies like Checkpoint, Cisco and Symantec.

clebio 7y ago

It depends on attack surface and what tooling you already have in place. But for example: > Finding suspicious outbound network activity https://blog.rapid7.com/2016/05/09/introduction-to-osquery-for-threat-detection-dfir/ https://blog.rapid7.com/2016/05/09/introduction-to-osquery-f...

wepple 7y ago

I’ve done a few small IR jobs in my time, and also have a hobby of reading every breach report that comes out. It seems the vast majority of breach discovery amongst typical companies is an engineer going “hrmm that’s odd”: a router at 100% CPU because it’s currently part of a DDoS attack. A DBA noticing a huge query they don’t recall running. Unusual login times for administrative accounts. Having email systems sinkholed for sending spam. And of course “all my files are encrypted?”