Develop a plan for breach detection

[ConsoleCatzirl]

• Write a spec

[ConsoleCatzirl]

Tangentially related: BonnyCI/hoist#312 adds a fail2ban role to mitigate abuse attempts.

[ConsoleCatzirl]

Options:

1. Deploy open-source IDS tools such as snort or OSSEC.
2. Build tooling around ELK to monitor or periodically query logs.

[SpamapS]

Network IDS would require that we somehow push traffic through our own routers. I believe that's entirely doable with security groups doing the egress, just not sure how much it might cost us in network performance.

We should also think about host IDS, like tripwire.

[SpamapS]

We can even take advantage of our cloudyness and mount disk snapshots to do tripwire checks and rootkit checks offline.