RE: Content monitorting in Application Security

["Ofer Shezaf" <Ofer.Shezaf () breach com>]

It is a very nice idea: when thinking about it spam filtering is quite
similar. 

Unfortunately my experience shows me that when you get to the small
details there is a lot of work (usually too much) when changing the
monitored protocol. We have though about applying our technology to
non-http environments, and while the underlying technology would
probably fit, the implementation itself requires way too much work. 

Some of the work needed is in the infrastructure elements (parsing for
example), but it also seems that when translated to a product the
technology gathered a lot of "know-how" of the specific environment it
work on.

Ofer Shezaf
CTO, Breach Security

Tel: +972.9.956.0036 ext.212
Cell: +972.54.443.1119
ofers () breach com
http://www.breach.com 


> -----Original Message-----
> From: Martin Schapendonk [mailto:martin.schapendonk () gmail com]
> Sent: Monday, January 24, 2005 9:29 AM
> To: Ofer Shezaf
> Cc: webappsec () securityfocus com
> Subject: Re: Content monitorting in Application Security
>
> I like the suggestion to check for (multiple) occurrences of
> SQL-statements etc.. If you think of it, it's just like UCE/UBE
> filtering.
>
> Maybe it's possible to use software like SpamAssassin and/or
> BogoFilter to determine if a file is "definitely insecure",
> "definitely secure" or "not sure". Of course, they would require a
> whole different ruleset and perhaps some extra training depending on
> the site, but I do think this may have some perspective.
>
> Also, performance wise this may be a good idea: SA and BF are designed
> for realtime email processing, so I don't see why they shouldn't be
> able to process a sufficient number of files, even on modest hardware.
>
> Regards,
>
> Martin
>
> --
>   Martin Schapendonk, martin.schapendonk () gmail com