Segurança cibernética: proposta de implementação de uma plataforma SIEM: Instituto Nacional de Tecnologias de Informação e Comunicação, IP

Abstract

Nowadays, it is undeniable that one of the biggest challenges for companies and institutions is to guarantee the security of their assets in their corporate network infrastructure. Timely monitoring and detection of undesirable behavioral patterns is of crucial importance to create a strong defense against possible adversaries, in this way, IT professionals need to access, monitor and analyze each of the logs generated by security mechanisms, applications and network devices, which is a very slow and costly task because these components generate a huge amount of logs. SIEMs platforms can help overcome these challenges, as these solutions allow users to have a global view of what happens in real time in a corporate network infrastructure. By collecting and consolidating the logs generated in a single central repository, it is possible to monitor, automate the analysis process and correlate events in order to automatically detect undesirable behavior so that the chances of a possible successful attack are quickly eliminated. In this perspective, the main objective of the work is to propose the implementation of a SIEM platform for detection and mitigation of sophisticated cyber-attacks in INTIC. To this end, an analysis was made of cybersecurity in INTIC's corporate network infrastructure and then a bibliographic and documentary research was carried out on the main security mechanisms currently used, security events and incidents, and finally around SIEM platforms and the main open/closed source, commercial or free source solutions used today. Based on the Gartner 2020 report, data on available solutions were collected and IBM QRadar, Splunk and AlienVault OSSIM solutions were considered for comparative analysis. From this comparative analysis, it was concluded that the solution that best suits the conditions and current reality of INTIC is AlienVault OSSIM and then its implementation was proposed. There was a need to create a virtualized corporate network infrastructure similar to that of INTIC using the VMware Workstation virtualization tool to test the solution in an environment close to the “real”