Difference between revisions of "Category:OWASP Logging Project"

From OWASP
Jump to: navigation, search
(Goals)
(Existing tools and use cases)
Line 27: Line 27:
  
  
== Existing tools and use cases ==
+
== Existing tools and use cases ==
  
<br>'''1) IDE integration''' (auto-completion, templates, logging policy definition support) for guiding software developers to define and provide meaningful logs
+
<br>'''1) IDE integration''' (auto-completion, templates, logging policy definition support) for guiding software developers to define and provide meaningful logs  
  
<br>'''IDE templates''' (Eclipse and NetBeans examples below) helping developers remember to log all necessary information while avoiding too much typing.
+
<br>'''IDE templates'''<br>
  
<br>'''OWASP ESAPI Logger''' interface (Logger.java) and implementations<br>http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API<br>http://code.google.com/p/owasp-esapi-java/downloads/list
+
http://www.owasp.org/index.php/File:Eclipse_Create_Template.png<br>
  
<br>For example, a template can provide checks/hints/defaults s.a. those defined by the OWASP Enterprise Security API :<br>- something equivalent to a generated logging session ID, or a hashed value of the session ID so they can track session specific events without risking the exposure of a live session's ID<br>- identity of the user that caused the event<br>- description of the event (supplied by the caller)<br>- whether the event succeeded or failed (indicated by the caller)<br>- severity level of the event (indicated by the caller)<br>- that this is a security relevant event (indicated by the caller)<br>- hostname or IP where the event occurred (and ideally the user's source IP as well)<br>- a time stamp
+
http://www.owasp.org/index.php/File:NetBeans_Create_Live_Template.png<br>
  
<br>'''2/ Code audit tools''' s.a. OWASP yasca can be easily adapted in order to ensure that logging standards are respected and that log messages are consistent and complete (content, format, timestamps)<br>See http://www.owasp.org/index.php/Category:OWASP_Yasca_Project<br>Related OWASP projects: http://www.owasp.org/index.php/Category:OWASP_Orizon_Project
+
http://wiki.netbeans.org/Java_EditorUsersGuide<br>
  
 +
<br>'''OWASP ESAPI Logger''' interface (Logger.java) and implementations<br>http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API<br>http://code.google.com/p/owasp-esapi-java/downloads/list
  
 +
<br>For example, a template can provide checks/hints/defaults s.a. those defined by the OWASP Enterprise Security API&nbsp;:<br>- something equivalent to a generated logging session ID, or a hashed value of the session ID so they can track session specific events without risking the exposure of a live session's ID<br>- identity of the user that caused the event<br>- description of the event (supplied by the caller)<br>- whether the event succeeded or failed (indicated by the caller)<br>- severity level of the event (indicated by the caller)<br>- that this is a security relevant event (indicated by the caller)<br>- hostname or IP where the event occurred (and ideally the user's source IP as well)<br>- a time stamp
  
 +
<br>'''2/ Code audit tools''' s.a. OWASP yasca can be easily adapted in order to ensure that logging standards are respected and that log messages are consistent and complete (content, format, timestamps)<br>See http://www.owasp.org/index.php/Category:OWASP_Yasca_Project<br>Related OWASP projects: http://www.owasp.org/index.php/Category:OWASP_Orizon_Project
  
 +
<br>
  
'''3) Integrating application logs into a Security Information Management configuration'''<br>OSSIM (http://www.ossim.net/) has numerous plugins for parsing webserver, appserver, WAF, IPS, IDS logs and generating/storing events in its standard format.
+
<br>  
  
Adding a plugin for parsing custom application logs is as easy as finding the correct regular expression provided that developers included all relevant information in the log message and that they have done so in a consistent way.
+
'''3) Integrating application logs into a Security Information Management configuration'''<br>OSSIM (http://www.ossim.net/) has numerous plugins for parsing webserver, appserver, WAF, IPS, IDS logs and generating/storing events in its standard format.  
  
You can refer to the OSSIM database model to see what data is stored for events.
+
Adding a plugin for parsing custom application logs is as easy as finding the correct regular expression provided that developers included all relevant information in the log message and that they have done so in a consistent way.  
  
See http://www.owasp.org/index.php/File:OWASP_Logging_Guide.pdf for more details/screenshots on application event integration and correlation via OSSIM
+
You can refer to the OSSIM database model to see what data is stored for events.  
  
 +
See http://www.owasp.org/index.php/File:OWASP_Logging_Guide.pdf for more details/screenshots on application event integration and correlation via OSSIM
  
 +
<br>
  
 +
<br>
  
 +
<br>
  
 +
<br>'''4) Reconstructing attacks'''<br>It is difficult to analyze, filter and generally reconstruct an attack because messages are spread around various log levels.
  
 +
See the Logging part of the OWASP ESAPI project<br>http://code.google.com/p/owasp-esapi-java/downloads/list
  
<br>'''4) Reconstructing attacks'''<br>It is difficult to analyze, filter and generally reconstruct an attack because messages are spread around various log levels.
+
Along the same lines, Arshan Dabirsiaghi's proposal of adding a security log level is very interesting<br>http://www.owasp.org/index.php/How_to_add_a_security_log_level_in_log4j
  
See the Logging part of the OWASP ESAPI project<br>http://code.google.com/p/owasp-esapi-java/downloads/list
+
<br>  
  
Along the same lines, Arshan Dabirsiaghi's proposal of adding a security log level is very interesting<br>http://www.owasp.org/index.php/How_to_add_a_security_log_level_in_log4j
+
<br>'''5) Implement scripts for filtering/scrubbing logs in order to enable log data sharing between organizations'''<br>Goal: information sharing around security events<br>Custom logger implementations based on the OWASP ESAPI might also filter out any sensitive data specific to the current application or organization, such as credit cards, social security numbers etc.  
  
 +
See the Logging part of the OWASP ESAPI project<br>See http://code.google.com/p/owasp-esapi-java/downloads/list
  
 +
<br>
  
<br>'''5) Implement scripts for filtering/scrubbing logs in order to enable log data sharing between organizations'''<br>Goal: information sharing around security events<br>Custom logger implementations based on the OWASP ESAPI might also filter out any sensitive data specific to the current application or organization, such as credit cards, social security numbers etc.
+
<br><br>  
  
See the Logging part of the OWASP ESAPI project<br>See http://code.google.com/p/owasp-esapi-java/downloads/list
+
<br>  
 
+
 
+
 
+
<br><span style="font-weight: bold;" /><br><br>
+
 
+
<br>
+
  
 
<br>  
 
<br>  

Revision as of 08:01, 7 August 2009

Main

The OWASP Logging Project [Roadmap] .

File:Owasp Logging Project Roadmap.pdf

File:OWASP Logging Guide.pdf

Goals

eventlog-mgt.jpg


Provide tools for software developers in order to help them define and provide meaningful logs

Provide code audit tools to ensure that log messages are consistent and complete (content, format, timestamps)

Facilitate the integration of logs from different sources

Facilitate attack reconstruction

Facilitate information sharing around security events




Existing tools and use cases


1) IDE integration (auto-completion, templates, logging policy definition support) for guiding software developers to define and provide meaningful logs


IDE templates

http://www.owasp.org/index.php/File:Eclipse_Create_Template.png

http://www.owasp.org/index.php/File:NetBeans_Create_Live_Template.png

http://wiki.netbeans.org/Java_EditorUsersGuide


OWASP ESAPI Logger interface (Logger.java) and implementations
http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API
http://code.google.com/p/owasp-esapi-java/downloads/list


For example, a template can provide checks/hints/defaults s.a. those defined by the OWASP Enterprise Security API :
- something equivalent to a generated logging session ID, or a hashed value of the session ID so they can track session specific events without risking the exposure of a live session's ID
- identity of the user that caused the event
- description of the event (supplied by the caller)
- whether the event succeeded or failed (indicated by the caller)
- severity level of the event (indicated by the caller)
- that this is a security relevant event (indicated by the caller)
- hostname or IP where the event occurred (and ideally the user's source IP as well)
- a time stamp


2/ Code audit tools s.a. OWASP yasca can be easily adapted in order to ensure that logging standards are respected and that log messages are consistent and complete (content, format, timestamps)
See http://www.owasp.org/index.php/Category:OWASP_Yasca_Project
Related OWASP projects: http://www.owasp.org/index.php/Category:OWASP_Orizon_Project



3) Integrating application logs into a Security Information Management configuration
OSSIM (http://www.ossim.net/) has numerous plugins for parsing webserver, appserver, WAF, IPS, IDS logs and generating/storing events in its standard format.

Adding a plugin for parsing custom application logs is as easy as finding the correct regular expression provided that developers included all relevant information in the log message and that they have done so in a consistent way.

You can refer to the OSSIM database model to see what data is stored for events.

See http://www.owasp.org/index.php/File:OWASP_Logging_Guide.pdf for more details/screenshots on application event integration and correlation via OSSIM





4) Reconstructing attacks
It is difficult to analyze, filter and generally reconstruct an attack because messages are spread around various log levels.

See the Logging part of the OWASP ESAPI project
http://code.google.com/p/owasp-esapi-java/downloads/list

Along the same lines, Arshan Dabirsiaghi's proposal of adding a security log level is very interesting
http://www.owasp.org/index.php/How_to_add_a_security_log_level_in_log4j



5) Implement scripts for filtering/scrubbing logs in order to enable log data sharing between organizations
Goal: information sharing around security events
Custom logger implementations based on the OWASP ESAPI might also filter out any sensitive data specific to the current application or organization, such as credit cards, social security numbers etc.

See the Logging part of the OWASP ESAPI project
See http://code.google.com/p/owasp-esapi-java/downloads/list






         *** We need your efforts and contribution to this project ***



Feedback and Participation:

We hope you find the OWASP Logging Project useful. Please contribute to the Project by volunteering for one of the Tasks, sending your comments, questions, and suggestions to owasp@owasp.org. To join the OWASP Logging Project mailing list or view the archives, please visit the subscription page.


Project Identification (Under work)

Project Leader: Marc Chisinevski



PROJECT INFO
What does this OWASP project offer you?
RELEASE(S) INFO
What does this OWASP project release offer you?
what is this project?
OWASP Logging Project

Purpose:The goals of this project are:

Provide tools for software developers in order to help them define and provide meaningful logs
Provide code audit tools to ensure that log messages are consistent and complete (content, format, timestamps)
Facilitate the integration of logs from different sources
Facilitate attack reconstruction
Facilitate information sharing around security events
who is working on this project?
Project Leader: Marc Chisinevski

Project Maintainer: Marc Chisinevski

Project Contributor(s): Marc Chisinevski,Anthony Lai, Sam Ng

how can you learn more?
Project Flyer/Pamphlet: []

Mail list: Subscribe or read the archives

Project Roadmap: To view, click here

Project main links: OWASP Logging Project; []

Project Health: Yellow button.JPG Not reviewed/Targeted at Level 1
To be reviewed under Assessment Criteria v2.0

Key Contacts
  • Contact Project Leader to contribute to this project,
  • Contact Project Leader or GPC to review or sponsor this project,
  • Contact GPC to report a problem or concern about this project or to update information.
Template:OWASP Logging Project - B

Pages in category "OWASP Logging Project"

The following 3 pages are in this category, out of 3 total.