The insufficient logging and monitoring flaw mostly happens as a result of a failed cybersecurity plan in regards to logging all failed authentication attempts, denied access, and input validation errors. It can occur at other points in the production environment, but is most associated with a failure to stop invalid login attempts.

It's a dangerous vulnerability because it means that cybersecurity teams won't respond to attacks because they don't know about them. This gives attackers a big advantage, letting them remain unnoticed while they try and further penetrate a system or upgrade their credentials. In fact, without proper logging and monitoring, it becomes very difficult or even impossible to detect and stop attacks before they can do significant damage.

Ready to test your skills with a challenge right now? Check this out:

How do attackers exploit insufficient logging and monitoring?

Any API is vulnerable to insufficient logging and monitoring if the logging level is not set correctly, if it is set too low, if error messages do not include enough detail or if no logging function is present at all.

An interesting example would be if a hacker obtained a large list of compromised user names for a website or service. Through experimentation, they could figure out that it takes three failed login attempts before they are locked out of the system, and before cybersecurity personnel are notified.

Armed with this information, instead of trying to brute force single accounts, they instead could write a script to try and log in as every name on their compromised list using common passwords like "123456" or "password." The trick is that they only try each user name once, or perhaps twice, keeping below the threshold for lockouts and alerts. If they get lucky, they will compromise at least a few passwords right off the bat. After that, they simply wait a day for the login counter to reset and run the process again using different passwords like "qwerty" or "god." If admins never detect what they are doing, attackers can go through the list many times and eventually compromise most accounts with weak passwords.

This happened in the OWASP supplied example where a video sharing platform was attacked using a credential stuffing attack that exploited the insufficient logging and monitoring vulnerability. Until the company started to get user complaints, it had no idea that the attack was happening. Eventually, they found evidence in the API logs, and had to issue a forced password change notification to all of their users, as well as report the attack to regulatory authorities.  

Eliminating the insufficient logging and monitoring vulnerability

Automation and constant monitoring can help put an end to this vulnerability. To start, all failed authentication attempts should be logged. And that log should be put into a format that is machine-readable like STIX and TAXII so that it can be ingested into a security information and event management (SIEM) system that is trained to look for attacks regardless of the thresholds used.

You should also protect your log files. Treat them as sensitive information and protect them from deletion or modification by attackers. A good policy is to both backup the log files and also encrypt them.

Finally, create custom dashboards and alerts so that any suspicious activities can be detected and responded to as quickly as possible. If you eliminate an attacker's time with the system, you remove their ability to use low and slow attack techniques to remain undetected.

Check out the Secure Code Warrior blog pages for more insight about this vulnerability and how to protect your organization and customers from the ravages of other security flaws. You can also try a demo of the Secure Code Warrior training platform to keep all your cybersecurity skills honed and up-to-date.