Trouble spotted on the network

We had a scare the other day with a critical cross-site scripting (XSS) attack that seemed to be entirely contained — source and destination — on our own network. Tracking it down and resolving the issue were fairly routine procedures, but it’s worth noting how it’s possible to spot potential security problems when you don’t have a world-class security operations center (SOC) that’s staffed with skilled analysts and stuffed with large-screen monitors and all the bells and whistles.