Managing Logs and Security Events CiscoWorks SIMS(Netforensics) Georg Bommer, Inter-Networking AG (Switzerland)
Table of Content Challenges/Problems Main Functionality Product Tour Report Examples Architecture and Implementations Summary
Challenges Complexity of environment Many different data formats Volume of information Problem of consolidation Correlation and comparing in realtime and for forensics
Requirements for SIM Normalize Synchronisation of time, Event ID, Event Priority, Event Category Aggregate Reduce duplicate information and False/Positives Correlate Identify real threat Visualize Provide multiple views of real-time and historical data
Normalization
Normalization
Aggregation
Aggregation
Aggregation
Correlation Rule based and Statistical
Rule based Correlation
Visualization
Product Tour
Device Map
Realtime Trends
Event Console
Notification
Alert Customization
Knowledge Base
Event Status
Reporting 250 Pre-defined reports Role/User specific report view PDF, HTML, CSV Format Automatic scheduling
Report Generation
Report Scheduling
Activity Assessment by Category
Activity Assessment by Severity
Threat Assessment
Risk Assessment Risk = Threat x Vulnerability x Asset Value
Architecture
Central Office with Branch Office Branch Office Central Office NIDS Firewall Real Time Consoles Firewall Router (n) Server Agent Router NIDS Server Provider Agent Master DB Engine
Central Office with 30 Branches 6 Branches 6 Branches 6 Branches 6 Branches 6 Branches Server Server Server Server Server Agent Agent Agent Agent Agent Central Office Real Time Consoles Engine Server (n) Master Router Server DB Provider NIDS Firewall Engine Engine Agent Fault Tolerant Solution Secondary Location Server Engine Real Time Consoles Master Server DB (n) Provider
Central Data Center Server Farm Central Office Engine Server Real Time Consoles Master (n) 20 Servers + Win Agents 20 Servers + Win Agents Engine 20 Servers + Win Agents Server Engine DB Provider Routers NIDS Blades FW Blade Engine Agent 20 Servers + Win Agents
Supported Devices Supported Devices - SIM Agents or Universal Agents Access Control and Authentication Antivirus Databases Policy + Configuration Management Firewall + VPN Host based IDS Network based IDS Operation System SIM Solution Web Server
Supported Devices Access Control and Authentication Cisco ACS Cisco IOS ACL Antivirus CA InoculateIT McAfee Virus Scan Symantec Norten Antivirus Databases Informix Microsoft SQL-Server My SQL Oracle Sybase
Supported Devices Firewall / VPN Checkpoint Cisco Firewal Service Module Cisco IOS Firewall Cisco VPN Concentrator Cisco Pix CyberGuard Secure Computing Sidewinder Symantec Enterprise Firewall Firewall Borderware CA etrust Gauntlet GNAT Box Lucent Brick Netguard Gaurdian Pro NetScreen Nokia Sonic Wall Sygate WatchGuard ZoneLabs
Supported Devices Host Based IDS Cisco Secure Agent Enterasys Dragen Quire Entercept HIDS ISS RealSecure SS Arbor Peakflow CA etrust Cybercop Monitor PentaSafe Symantec ITA Tripwire Network Based IDS Enterasys Dragon ISS RealSecure Snort NIDS Sourcefire Tripwire NIDS Cisco PIX IDS Cisco IOS IDS CypberCop Net IDS Network Flight Recorder
Supported Devices Policy and Configuration-Management Symantec ESM Cisco Works HP OpenView Micromuse Optivity Solsoft Tivoli Unicenter Websense
Supported Devices Operating Systems SUN Solaris Red Hat Linux Microsoft Win 2000 + NT Events IBM AIX HP-UX Silcon Graphics IRIX Open BSD SuSE SIM Solution ISS Site Protector
Supported Devices Web Server Apache Microsoft IIS Netscape Enterprise IPlanet
Summary Event monitoring Real-time event correlation Integrated threat assessment Advanced visualization Comprehensive reporting & forensics Support for multivendor devices and systems
Benefit Eliminates manual device monitoring Resolves security event management in realtime from a single console Simplifies notification and alert management Transparent view on security and related problems => Increase in productivity => Lower operational cost => Better Security over all
Applications Operating Systems Intrusion Detection Encryption/PKI Content Security Authentication Access Control + VPN Conclusion Management Log + Event Consolidation, Correlation
Vielen Dank! Georg Bommer Inter-Networking AG (Switzerland) gbo@internetworking.ch
CiscoWorks SIMS Appliance