The Dark Side of Monitoring
•Als PPTX, PDF herunterladen•
0 gefällt mir•317 views
We all use monitoring - after all, we all want to ensure that our applications are working as expected. But can hackers use it to exploit our application? Join me to explore different ways to exploit application monitoring tools, and what mitigations we can use.
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Ähnlich wie The Dark Side of Monitoring
Ähnlich wie The Dark Side of Monitoring (8)
Mehr von Soluto
Mehr von Soluto (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
The Dark Side of Monitoring
- 1. @omerlh The Dark Side of Monitoring Omer Levi Hevroni May 2019
- 3. @omerlh Can Hackers Use It Too?
- 7. @omerlh Threat Modeling? ● What are we building? ● What can go wrong? ● What are we doing about it? ● Did we do a good job?
- 9. @omerlh
- 10. @omerlh
- 14. @omerlh Threat Modeling ● What are we building? ● What can go wrong? ● What are we doing about it? ● Did we do a good job?
- 15. @omerlh White-box Monitoring Monitoring based on metrics exposed by the internals of the system, including logs, interfaces like the Java Virtual Machine Profiling Interface, or an HTTP handler that emits internal statistics.
- 16. @omerlh White-box Monitoring for Kubernetes ● Probes (liveness/readiness) ● Prometheus
- 17. @omerlh Probes
- 18. @omerlh What are we building?
- 19. @omerlh Probes
- 20. @omerlh Why? ●Check dependencies ○ Databases ○ Other micro-services ●Kill services if it misfunction before users experience it
- 22. @omerlh What Can go wrong?
- 23. @omerlh Exploiting liveness - information disclosure
- 24. @omerlh Exploiting liveness – Denial of Service
- 25. @omerlh
- 26. @omerlh What are we doing about it?
- 28. @omerlh Caching Source code - Kamus
- 30. @omerlh What are we building?
- 31. @omerlh Prometheus ● Monitoring system ● Time-Series database ● Alerting system ● Auto-discovery https://prometheus.io/
- 33. @omerlh What Can go wrong?
- 34. @omerlh Exploiting Prometheus - information disclosure
- 35. @omerlh
- 37. @omerlh What about this metric?
- 38. @omerlh Here is the code behind it…
- 39. @omerlh What Can We Do About It?
- 41. @omerlh Prometheus Metrics Limit https://www.omerlh.info/2019/03/04/keeping-prometheus-in-shape/
- 42. @omerlh Did we do a good job?
- 43. @omerlh Threat Modeling ● What are we building? ● What can go wrong? ● What are we doing about it? ● Did we do a good job?
- 46. @omerlh What are we building?
- 47. @omerlh Black-box Monitoring Testing externally visible behavior as a user would see it.
- 49. @omerlh What Can go wrong?
- 50. @omerlh STRIDE S – Spoofing T – Tampering R – Repudiation I – Information Disclosure D – Denial of Service E – Elevation of Privileges
- 51. @omerlh Spoofing
- 55. @omerlh What are we doing about it?
- 56. @omerlh Potential Mitigations ● Least Privilege ● Block access ● Tracing ● Limit to test data only
- 57. @omerlh Did we do a good job?
- 59. @omerlh Can Hackers Use It Too?
- 60. @omerlh Key Take Away ● Monitoring is just code ● Careful when exposed to the internet ● Use cache when possible ● Conduct threat model for black-box monitoring
- 63. @omerlh Thank You! Omer Levi Hevroni April 2019