Belajar Security Tester - Logging, Monitoring & Detection Test

#Pendahuluan

Setelah di episode 18 kita menguji network security, pada episode ini kita membahas pertahanan terakhir: logging & detection. Jika serangan tidak terdeteksi, attacker bisa bersembunyi berbulan-bulan.

#Logging Coverage Testing

#Apa yang Harus Di-Log?

text

Events yang Wajib Di-Log:
├── Authentication events (login, logout, failure)
├── Authorization events (access denied)
├── Input validation failures
├── Server errors (5xx)
├── File uploads
├── Admin actions
├── API access dengan sensitive data
└── Rate limiting triggers

#Test Logging

bash

# Trigger logging events
# 1. Login gagal
curl -X POST http://localhost:3000/api/login \
  -H "Content-Type: application/json" \
  -d '{"email":"test@test.com","password":"wrong"}'
 
# 2. Access denied
curl http://localhost:3000/api/admin/users
 
# 3. Server error
curl http://localhost:3000/api/error
 
# Cek apakah events ter-log
# (tergantung logging system yang digunakan)

#Log Injection

bash

# Test apakah log bisa diinjeksi
curl "http://localhost:3000/search?q=test%0D%0AInjected+log+entry"

#Detection Rules Testing

#SIEM Rules

yaml

# Contoh detection rule
# Failed login > 5 kali dalam 5 menit
- alert: BruteForceLogin
  condition: count(failed_login) by src_ip > 5 within 5m
  severity: high

#Test Detection

bash

# Trigger detection rule
for i in $(seq 1 10); do
  curl -s -o /dev/null -X POST http://localhost:3000/api/login \
    -H "Content-Type: application/json" \
    -d '{"email":"test@test.com","password":"wrong"}'
done
 
# Cek apakah alert ter-trigger
# (tergantung SIEM system yang digunakan)

#Alerting Verification

text

Alerting Checklist:
├── Critical alerts: dikirim ke tim dalam < 5 menit
├── High alerts: dikirim ke tim dalam < 1 jam
├── Alert escalation: ada prosedur escalation
├── Alert fatigue: jangan terlalu banyak false positives
└── On-call rotation: ada yang bertanggung jawab 24/7

#Security Monitoring

#WAF (Web Application Firewall)

bash

# Test WAF rules
curl "http://localhost:3000/search?q=<script>alert(1)</script>"
curl "http://localhost:3000/api/users?id=1+OR+1=1"
 
# Cek apakah request diblokir

#Runtime Protection

bash

# Test RASP (Runtime Application Self-Protection)
# Trigger known attack patterns
# Cek apakah aplikasi mendeteksi dan memblokir

Tip

Security testing harus menguji apakah serangan terdeteksi, bukan hanya apakah serangan berhasil. Detection testing sama pentingnya dengan vulnerability testing.

#Praktik: Detection Test

bash

# 1. Trigger multiple failed logins
for i in $(seq 1 10); do
  curl -s -o /dev/null -X POST http://localhost:3000/api/login \
    -d '{"email":"test@test.com","password":"wrong"}'
done
 
# 2. Trigger SQL injection attempt
curl "http://localhost:3000/api/search?q=' OR 1=1--"
 
# 3. Cek apakah events ter-log dan alert ter-trigger

#Penutup

Logging: pastikan semua security events ter-log (auth, access, errors).
Detection: test apakah detection rules ter-trigger oleh serangan.
Alerting: pastikan alert dikirim tepat waktu ke tim yang bertanggung jawab.
WAF/RASP: test apakah pertahanan runtime berfungsi.

Di episode 20 selanjutnya kita akan membahas compliance testing — testing terhadap requirements seperti OWASP ASVS, PCI DSS, dan GDPR. Sampai jumpa di episode 20!