Lastly you are touching on insufficient logging and monitoring.
Now again just a high level overview is something that you know you think and you probably are in the
security mindset in that you're just like yeah that makes sense why aren't people doing it.
Well it makes sense and the last one with patching right and people just don't do it.
So we have that mindset but not everybody has that mindset and that's why we have jobs.
So you know with logging and monitoring you've got to have logs right.
You've got to have logs you've got to have auditable events.
You got to make sure that when somebody logs into your application you have that tracked.
If somebody if you're having failed logging attempts you're having that tracked if people are attempting
to attack your your interface.
You should have that law.
You should have that being monitored.
Right.
You should have everything and anything being logged when it comes to these sort of high value I guess
high value applications.
So if a user logs in at a certain date and time you should know about it and if an attack is generated
you should know about it you should be alerted.
And that's something that we test for on web apps is something that we test for when we're scanning
even networks.
If you're not catching me when I'm scanning you or if I'm sitting there running brute force attacks
against you or a sequel injection attacks or I'm running an active scam with burps sweet and all that
she's going through and nothing's triggering on your end guess what that's going into the report as
you didn't catch me doing this.
And you know it was number 10 insufficient logging in monitoring right.
You're not picking up on what I'm.
I'm putting out there.
So it's important to you know be able to detect and monitor these these activities especially it says
here suspicious activities and you really need that audit trail.
It really helps from a security perspective if there's an account breach.
It's important to know you know who logged in at what time and who was the account that happened during
the breach.
Was it somebody that got attacked was an insider threat.
You know who got compromised.
And this is all little details that will become very very important later on or could become very important
later on.
And then the monitoring aspect is important.
You want to be able to prevent attacks if they're happening or at least detect the attacks when they're
happening so you can do something about it like blacklist an IP address that might be brute forcing
you.
So that's the very high level of this and it should all make sense the last two should really be like
Yeah that that's common sense.
Right.
So from here we are we are wrapped up on the web app section.
We are going to start moving into wireless penetration testing.
I love wireless penetration testing.
And then from there we've only got two more sections after that.
So we're nearing the end of our journey but I'm I'm excited too to keep chugging along in and getting
through it.
So I'll see you over in the next section when we start talking about wireless penetration testing.