System for Continuous Collection of Contextual Information for Network Security Management and Incident Handling

Investor logo

Warning

This publication doesn't include Faculty of Economics and Administration. It includes Institute of Computer Science. Official publication website can be found on muni.cz.
Authors

HUSÁK Martin LAŠTOVIČKA Martin TOVARŇÁK Daniel

Year of publication 2021
Type Article in Proceedings
Conference ARES 2021: The 16th International Conference on Availability, Reliability and Security
MU Faculty or unit

Institute of Computer Science

Citation
Web https://dl.acm.org/doi/abs/10.1145/3465481.3470037
Doi http://dx.doi.org/10.1145/3465481.3470037
Keywords Cybersecurity;Network monitoring;Cyber situational awareness;Incident response;Incident handling
Attached files
Description In this paper, we describe a system for the continuous collection of data for the needs of network security management. When a cybersecurity incident occurs in the network, the contextual information on the involved assets facilitates estimating the severity and impact of the incident and selecting an appropriate incident response. We propose a system based on the combination of active and passive network measurements and the correlation of the data with third-party systems. The system enumerates devices and services in the network and their vulnerabilities via fingerprinting of operating systems and applications. Further, the system pairs the hosts in the network with contacts on responsible administrators and highlights critical infrastructure and its dependencies. The system concentrates all the information required for common incident handling procedures and aims to speed up incident response, reduce the time spent on the manual investigation, and prevent errors caused by negligence or lack of information.
Related projects:

You are running an old browser version. We recommend updating your browser to its latest version.