Ask HN: How do you continuously monitor web logs for hack attempts?

Re:Ask HN: How do you continuously monitor web logs for hack... by wglb on Tuesday May 08, 2018 @01:17PM (#17022647)

Might I suggest a little research, e.g., reading http://cs.unc.edu/~fabian/course_papers/PtacekNewsham98.pdf

This points out how WAF/NIDS is just a speed bump for a serious attacker.

You may conclude that they don't really 1) remove attack surface 2) Unclear if they really do this, and if they do what value there is 3) See the papers for detail on the differences 4) Zero cost to purchase, but what cost to maintain, run, keep up? 5) see #4 6) even if you have a large web farm?

This paper was writen 20 years ago.

[ Parent | on HN ]

Re:Ask HN: How do you continuously monitor web logs for hack... by peterwwillis on Tuesday May 08, 2018 @03:52PM (#17024251)

I already addressed this. The WAF is a temporary solution. It is not targeted at "serious attackers", it is targeted at drive-by scans and generic exploits.

[ Parent | on HN ]