Detecting intrusions on public-facing applications and machines

The term "public facing" refers to an application or system that is not only accessible from within the internal network but from the Internet as well. These applications are often connected to databases like MySQL database, standard services like Server Message Block (SMB) or Secure Shell (SSH), and other applications with internet-accessible open sockets like web servers. As web servers are open to access over the Internet, they are highly vulnerable to cyberattacks.

The weakest links

In the 2020 SonicWall Cyber Threat Report, it was revealed that cyberattacks on web applications increased by 52 percent in 2019 with over 40 million attacks reported. Malicious actors may attempt to take advantage of a weakness in internet-facing computers or programs using software, data, or commands in order to cause unintended or unanticipated behavior. The weakness could be a bug or a design vulnerability.

One of the most common attack methods is the SQL injection method that consists of short injection strings. In this method, the attacker injects a SQL query via the input data from the client to the application. This attack method can easily allow attackers to read, modify, or delete sensitive data from the database; execute admin operations on the database like shutting down the database management system; or give commands to the operating system. This means the severity of a SQL injection attack depends on the attacker’s skill and imagination.

Detecting intrusions that exploit vulnerabilities

According to MITRE ATT&CK, cyberattackers often exploit public-facing applications to gain initial access to an organization's network. To detect any exploitation attempts, it's important to monitor application logs for abnormal behavior. The lack of proper logging and monitoring methods can allow a majority of the attackers' malicious activities to go undiscovered.

In order to accurately detect intrusions, it's important to understand application and network traffic. A security information and event management solution not only monitors your applications and machines to provide information on abnormal occurrences faced in your network in real time, but also detects security events that may indicate attempted or successful exploitation. For example, by implementing thorough log inspection, you can spot malicious scripts immediately and respond before they impact your organization.

The other method that can help in identifying intrusions on public-facing applications is packet inspection. This is when the network traffic is dissected to distinguish between malicious traffic and non-malicious traffic. By monitoring and analyzing inbound and outbound traffic in your network, you can determine if a particular application is compromised, enabling you to stop a potential data exfiltration attempt or a botnet attack.

Best practices to mitigate exploitation

Protecting public-facing applications and machines enables organizations to gain control over their overall cybersecurity posture. To prevent vulnerabilities in your network from being exploited by malicious actors, here are some best practices you can follow:

• Scan applications and systems for vulnerabilities regularly. Analyze the reports and immediately attend to any discovered security issues.
• Limit the attacker's level of access in compromised applications by using the principle of least privilege on service accounts.
• Update software in your applications and machines frequently to the latest versions in order to prevent intrusions.

How Log360 can help detect and mitigate this attack

Log360 monitors all web servers in your network to look for vulnerabilities. Log360's event correlation engine contains predefined rules for detecting SQL injection attacks. For example, if there are repeated SQL injection attempts in a particular web server, an alert will be triggered and the security admin will be notified via email or SMS.

The security admin can then immediately investigate the security event and can either shut down the web server or block the user while also checking for vulnerabilities and removing them. This response action can also be automated by using incident workflows, saving you time and effort without compromising on web security.

Log360 also provides out-of the-box reports for Apache and IIS web servers, Oracle database servers, and Microsoft SQL servers.