Re:Ask HN: How do you continuously monitor web logs for hack...
by technion on Tuesday May 08, 2018 @05:32AM
(#17019796)
In addition to the points discussed..
If you follow the Geekflare link to modsecurity, and then follow the link there to a download page, there's this warning:
>NOTE: Some instabilities in the Nginx add-on have been reported (see the Github issues page for details). Please use the "nginx_refactoring" branch where possible for the most up to date version and stay tuned for the ModSecurity version 4.
That's not something I would suggest throwing in production, given that warning has been there for years.
The post itself describes Shadow daemon as "probably defunct".
Ironbee's last commit was two years ago and I get an nxdomain looking for their website.
AWS WAF is both expensive and and extremely manual. You won't get anything out of it without a major labour investment.
Nginx's built in WAF is only in the pro edition, and outside the price of many people.
This whole discussion however depends on your customer. I have an agency I support where I have to provide a report on every single hack attempt. That means if my Rails application gets hit with said three year old Wordpress exploit, and the web server "404", I have to report on how we "blocked" it. And no, "not applicable" is not an answer.
So we throw money at commercial products. And sometimes I recommend doing so. But like security can involve just being aware of your risks, this use of a WAF is about being aware of the real problem you're solving, which is a paper work based one.
If you follow the Geekflare link to modsecurity, and then follow the link there to a download page, there's this warning:
>NOTE: Some instabilities in the Nginx add-on have been reported (see the Github issues page for details). Please use the "nginx_refactoring" branch where possible for the most up to date version and stay tuned for the ModSecurity version 4.
That's not something I would suggest throwing in production, given that warning has been there for years.
The post itself describes Shadow daemon as "probably defunct".
Ironbee's last commit was two years ago and I get an nxdomain looking for their website.
AWS WAF is both expensive and and extremely manual. You won't get anything out of it without a major labour investment.
Nginx's built in WAF is only in the pro edition, and outside the price of many people.
This whole discussion however depends on your customer. I have an agency I support where I have to provide a report on every single hack attempt. That means if my Rails application gets hit with said three year old Wordpress exploit, and the web server "404", I have to report on how we "blocked" it. And no, "not applicable" is not an answer.
So we throw money at commercial products. And sometimes I recommend doing so. But like security can involve just being aware of your risks, this use of a WAF is about being aware of the real problem you're solving, which is a paper work based one.