If you have a mid-sized Rails app, with say 2-3 developers working on it, a full time security engineer would probably be overkill. Anyone have any recommendations of services/consultancies to be able to tell "oh, someone is hacking us right now" or "our page which has stripe.js on it has been compromised"?
I'm hoping for automated tools, services to install on our servers, or security auditors who have an out of the box package.
Tinfoil Security (https://www.tinfoilsecurity.com/) has automated scanners and seems to keep up to date with all the vulnerabilities quickly, like in case of the rails vulnerability recently.
Actually, I've had really bad experiences with Detectify. Their results didn't provide anything useful that I couldn't have gotten from something like Nessus. They have a pretty nice design, but not much in the way of actual useful security.
I'd Highly recommend Nessus as well. OpenVAS is another that is alright. Most scanners seems to favor false positives though, so I wouldn't put a ton of weight behind their results.
But since the question was one of a live monitor that detects intrusion, I've never heard of such a thing. There's always the possibility of aliasing `mysqldump' or `pg_dump' to another command that emails your admins, or other manual commands that shouldn't be run throughout the course of the day. My personal boxes run such an email script anytime someone logs in as root, and emails the logfile anytime someone uses sudo. That won't help against SQLi, but might against RCE that's allowed someone to tunnel into your box.
But, in the long run, there's nothing that won't beat subscribing the the security lists of all the software you run to get immediate notice of any vulnerabilities, hiring a pen tester, and stopping every day to read the code you've written to discover what kind of edge cases might help an attacker compromise your system.
Dear throaway132,
I am one of the founders of Detectify and, like inkel above, I am very curious to hear your feedback regarding your experience using Detectify. Please respond publicly here or DM me at piotr#detectify.com. Looking forward to hearing from you soon!
I'm hoping for automated tools, services to install on our servers, or security auditors who have an out of the box package.
This is the only automated tool I know about: http://brakemanscanner.org/