Implementing open-source security information and event management system (SIEM) for private cloud infrastructure of DLSU CCS-TSG
Clicks: 4
ID: 285552
2022
Article Quality & Performance Metrics
Overall Quality
Not rated
Combines reader engagement with the AI quality analysis. This
article has not been analysed, so there is no overall score —
reader engagement is measured and shown alongside.
Reader Engagement
Steady Performance
0.9
/100
4 views
0 readers
AI Quality Assessment
Not analyzed
Readership in this journal
SteadyRanked #317 of 3,757 articles by views in Malay Journal
Most read
Least read
Bar heights use a square-root scale. Only the 120 most-read articles are drawn; the journal has 3,757 in total.
Mint this article as an NFT
Not yet mintedCreate a permanent, verifiable on-chain record of this article on the Scimatic Network. The NFT is held in your Journament account, and you can withdraw it to your own wallet at any time.
5
SUSD
one-off · no wallet required
Abstract
Cybersecurity is an essential part of IT operations in the 21st century, there has been an increase in attacks on businesses by malicious individuals for monetary gain to access sensitive information, and manually investigating each host for suspicious activity is ineffective and reactive, and most of the time early warning signs of an attack are hard to identify. Security Information and Event Management (SIEM) is a set of tools and services that can provide a holistic overview of the organization's information security posture. However, SIEM can be expensive because of its license cost, maintenance, and resource requirements. This project evaluates known open-source SIEM solutions using Strength and Weakness, and Opportunity and Threats analysis that fit with the needs of DLSU CCS-TSG with minimal cost implementation design in mind. The chosen SIEM was deployed, configured, and optimized to improve the detection capabilities for adversarial tactics based on the MITRE ATT&CK framework on Unix-based Operating Systems. To validate the efficacy of the SIEM deployed and rule optimization in system auditing, an attack simulation was conducted based on commands from tactics for Discovery, Credential Access, and Persistence from MITRE ATT&CK. In conclusion, the SIEM helped the organization to centrally collect data across the network environment to gain real-time visibility into activities that may potentially induce risk and help the organization address the issues before becoming a significant financial risk. Lastly, it was proven that optimizing both SIEM and host system auditing to correlate and work with each other improved the detection capabilities of the SIEM. However, a proper set of training to manage, maintain, and improve the skillset and gain experience in cybersecurity to discern potential threats vs. false positives is an essential part of the SIEM to be effective.
Keywords: Cyber Security Operations, SIEM, AuditD, Intrusion Detection, Open-Source
| Reference Key |
persistent_1760655946_68f17a4aa48e7
Use this key to autocite in the manuscript while using
SciMatic Manuscript Manager or Thesis Manager
|
|---|---|
| Authors | Vidanes, Elijah Dale M. |
| Journal | Malay Journal |
| Year | 2022 |
| DOI |
DOI not found
|
| URL | |
| Keywords | Keywords not found |
Citations
No citations found. To add a citation, contact the admin at info@scimatic.org
Comments
No comments yet. Be the first to comment on this article.