This will require the ability to: count detection points events for each threshold per IP address, and per user, and do this for every request change application logging level, raise alerts to operations staff, change the status of an order, terminate website user sessions, redirect responses, block individual requests, disable check-out functionality for individual users, block access to the whole website for an IP address and for individual IP addresses, reset blocks display a monitoring dashboard Chapter 10 : Case Study of B2B Web Services AppSensor applied to a system that has a small number of strongly authenticated (system) user accounts. Background A manufacturer exposes selected suppliers to its acquisition systems via web services. The permitted web service request source locations are controlled by network firewall rules which are monitored and which have robust change control processes. Additionally customers must have a current, valid and non-revoked X.509 certificate. Security requirements were defined at the start of the implementation of the services, and were verified during design reviews, static code analysis (code review), dynamic testing. An independent specialist security company undertakes penetration testing at each release. There is ongoing external and internal vulnerability assessment scanning daily. Suppliers have strict security obligations placed on them and their development processes. However, the manufacturer is concerned about misuse of the web services by a rogue insider within any of the supplier organizations. Objectives Block clearly malicious requests to allow time for further investigation
This will require the ability to: count detection points events for each threshold per IP address, and per user, and do this for every request change application logging level, raise alerts to operations staff, change the status of an order, terminate website user sessions, redirect responses, block individual requests, disable check-out functionality for individual users, block access to the whole website for an IP address and for individual IP addresses, reset blocks display a monitoring dashboard Chapter 10 : Case Study of B2B Web Services AppSensor applied to a system that has a small number of strongly authenticated (system) user accounts. Background A manufacturer exposes selected suppliers to its acquisition systems via web services. The permitted web service request source locations are controlled by network firewall rules which are monitored and which have robust change control processes. Additionally customers must have a current, valid and non-revoked X.509 certificate. Security requirements were defined at the start of the implementation of the services, and were verified during design reviews, static code analysis (code review), dynamic testing. An independent specialist security company undertakes penetration testing at each release. There is ongoing external and internal vulnerability assessment scanning daily. Suppliers have strict security obligations placed on them and their development processes. However, the manufacturer is concerned about misuse of the web services by a rogue insider within any of the supplier organizations. Objectives Block clearly malicious requests to allow time for further investigation