Syslog for SIEM using iSecurity Real-Time Monitoring of IBM i Security Events
17
Syslog for SIEM using iSecurity Real-Time Monitoring of IBM i Security Events
description
Syslog for SIEM using iSecurity Real-Time Monitoring of IBM i Security Events. Syslog – Why and How?. Fact : Multi platform environments are the reality at nearly all companies. - PowerPoint PPT Presentation
Transcript of Syslog for SIEM using iSecurity Real-Time Monitoring of IBM i Security Events
Syslog for SIEM using iSecurityReal-Time Monitoring of IBM i Security Events
Syslog – Why and How?
• Fact: Multi platform environments are the reality at nearly all companies.
• Company Goal: Consolidate relevant event information from multiple environments onto a single console require a SIEM (Security Information & Event Manager solution). Optimally, security event information should be both infrastructure related as well as application related.
• Method: Syslog is the most widely used protocol for sending alert messages in real time to SIEM solutions.
• Raz-Lee’s iSecurity Partners: • IBM Tivoli Security Manager • Q1Labs (recently purchased by IBM)• RSA enVision• GFI• iSecurity also proven with Arcsight, HPOpenview, CA Unicenter and others.
System Information and Event Manager (SIEM) Products
IBM i IBM iPCPC Linux Unix MF
Individual & Multiple; System Management
iSecurity
Syslog (After optional filtering)
Typical Syslog Environment
… and other SIEM Products
4
ComplianceEvaluator
Visualizer
Evaluation
Protection FirewallAuthority on DemandAnti-Virus ScreenPasswordActionNative Object Security
DatabasesAP-Journal View FileScope
iSecurity Overview – Syslog Coverage
Assessment
PCI, HIPAA, SOX orSecurity Breach orManagement Decision
2
Auditing AuditCapture User Management System ControlUser Profile ReplicationSystem Value ReplicationCentral Admin
3
4
5
7
6
8
1
Issue Real-Time Alerts via iSecurity Action
QAUDJRN (Audit)
Network Security (Firewall)
Critical OS messages (QSYSOPR/QSYSMSG)
Database Journals
(AP Journal)
Authority changes (Authority on
Demand)
Real-Time Alert handling in iSecurity
Execute CL Scripts
Send e-mail Write to MSGQ Write to SYSLOG
Send SMS, SNMP, Twitter, etc.
Syslog in iSecurity
• iSecurity sends Syslog security event information originating from:• the system’s infrastructure (QAUDJRN, network access, virus detection product,
user profile changes including requests for stronger authorities, etc.) • business-critical applications (not only field level writes & updates but also
unauthorized READ accesses to sensitive data)
• iSecurity includes advanced filtering capabilities to select which events are sent to SIEM for analysis can control Syslog “traffic”
• “Super fast” iSecurity Syslog implementation enables sending extremely high volumes of information with virtually no performance impact.
• Syslog message structure is easily definable by each site and can include event-specific values such as user profile name, field-level “before” value, etc.
Syslog Success Stories (names available upon request)
• Large insurance company
• Sends all field-level data changes via AP-Journal’s Syslog facility to RSA enVision
• Monitors changes to ensure that only authorized PROD* users who also have “change” authority change data by more than X% or Y (specific amount)
• More than 1000 transactions/second are sent via Syslog; CPU overhead <1%
• Manage journal change file on PC rather than on IBM i
• AP-Journal produces field-level change reports to corporate and application managers
• Planned integration of Syslog from iSecurity Audit (based on QAUDJRN system journal) and iSecurity Firewall in 1Q2012
Syslog Success Stories (names available upon request)
• Very large mortgage bank
• Monitors all Firewall rejects, sending reject information via Syslog to Arcsight
• Monitors all QAUDJRN system journal activities via Audit, sending important event information via Syslog
• Arcsight performs advanced forensic analysis on Firewall and Audit log information
• Products produce auditing reports to both internal and external auditors
Syslog Success Stories (names available upon request)
• Large national airport authority
• For years they sent alerts to internal AS/400 messages queues. Simply by checking message headers, the Syslog facility sends SNMP alerts to HP OpenVIew.
• All definitions of new user profiles with high authorities, or changes to such user profiles, are sent as SNMP alerts to HPOV.
• Upcoming implementation of “mass SNMP” capability; they will define which QAUDJRN audit types NOT to send SNMP traps for, and all QAUDJRN entries with the other audit types will automatically be sent, en masse to HPOV with very little overhead
Syslog Attribute Definitions
For each alert message, the “First level message” (&1) is appended to the pre-defined Message Structure.
Syslog Severity range can be defined.
This option shown on following slide.
Set Syslog handling per Audit sub-type
Severity level can be set for each audit entry-type/sub-type combination.
Variables beginning with & are replaced withactual event values. &DPRICE(B) is the previousprice (“before value”) of the item.
Defining Syslog message format
Syslog messages written when special user authority added or removed. Note multi-product, multi-system & multi-IP messages.
Syslog Messages in (free) Kiwi Syslog Daemon
Note real-time user-defined messages from AP-Journal containing previous and new quantity and price values.
Syslog Messages in (free) Kiwi Syslog Daemon
Downloadable iSecurity Resources (1/2)
• Free Assessment Tool • Compliance Information (PCI, SOX, HIPAA…)• iSecurity Presentation• iSecurity Data Sheets• Case Studies & White Papers • Raz-Lee Security’s Corporate Blog• Twitter Updates
Downloadable iSecurity Resources (2/2)
• Short Demo and Training Videos:
• iSecurity in 3 Minutes! • PCI Compliance with Compliance Evaluator• User and System Value Replication• Creating security rules using Visualizer• GUI Queries and Reports• GUI 4.1 Improvements• Visualizer QuickDemo – Highly Recommended!• Visualizer User Profile and Queries Training
