Optimizing security monitoring in air-gapped infrastructure
Loading...
URL
Journal Title
Journal ISSN
Volume Title
School of Science |
Master's thesis
Unless otherwise stated, all rights belong to the author. You may download, display and print this publication for Your own personal use. Commercial use is prohibited.
Authors
Date
Department
Major/Subject
Mcode
Degree programme
Language
en
Pages
42
Series
Abstract
Air gapped Linux infrastructures cannot rely on cloud services for monitoring or external threat intelligence. Monitoring has to be managed locally and this is difficult because most built-in rules are broad, noisy or heavy on resources. In this thesis, a framework was developed to make rule based monitoring fit better for such isolated environments. The framework has three parts: first studying the environment, then linking adversary behavior with the MITRE ATT&CK framework and finally checking detections against defined scenarios. For simulation of attack scenarios, Elastic SIEM is used. The evaluation led to practical changes: rule with no relevance were disabled, missing coverage was added and noisy rules were tuned. As a result, coverage of real adversary attack techniques improved while unnecessary alerts and load were reduced. The study shows that monitoring in air gapped Linux systems can be improved when guided by adversary behavior and by the real conditions of the environment.Description
Supervisor
Gunn, LachlanThesis advisor
Gligoroski, DaniloNymalm, Sören