Flexible visualization of a 3rd party Intrusion Prevention (Security) tool: A use case with the ELK stack
- Brookhaven National Laboratory (BNL), Upton, NY (United States)
A difficult aspect of cyber security is the ability to achieve automated real time intrusion prevention across various sets of systems. To this extent, several companies are offering comprehensive solutions that leverage an "accuracy of scale" and moving much of the intelligence and detection on the Cloud, relying on an ever-growing set of data and analytics to increase decision accuracy. Often, they provide tools to visualize the decision workflows in attack prevention (as well as tune the algorithm) but those solutions are not always practical as companies see the problem as "global" that is, from a unified Cyber-security standpoint. However, a key to a successful Cyber-security program is transparency and trust: from an experimental team viewpoint, this specifically means having the ability to immediately see what and from where, who has been blocked and being able to inform the community in case of a revoked access without the need for filing a "ticket" (that may eventually be answered) – in other words, rapid response to their user-base is essential but solutions targeting "sub-groups" in an organization are not often available. We have come up with a versatile solution leveraging the ELK stack (Elasticsearch, Logstash, & Kibana) and an IPS (Intrusion Prevention System) based WAF (Web Application Firewall) from Signal Sciences. Signal Science allows the streaming of detailed logs in a Logstash format suitable for custom solutions for visualization. By combining these two tools, we have strengthened our security posture and enabled individual experiments to monitor their own traffic. Specifically, the IPS WAF provides unique data such as country of origin, protocol, response code, source IP, and paths accessed. In this contribution, we will show how we engineered a visualization solution so experiment groups could access a dashboard with predefined graphs but also, where they can create individual customizable dashboards used to display blocked traffic and troubleshoot latency issues. We will discuss the details and procedures for developing and configuring these tools and how it benefits cyber security postures across our scientific based environment.
- Research Organization:
- Brookhaven National Laboratory (BNL), Upton, NY (United States)
- Sponsoring Organization:
- USDOE Office of Science (SC), Nuclear Physics (NP)
- Grant/Contract Number:
- SC0012704
- OSTI ID:
- 1996621
- Report Number(s):
- BNL-224735-2023-JAAM; TRN: US2405141
- Journal Information:
- Journal of Physics. Conference Series, Vol. 2438, Issue 1; Conference: 20. International Workshop on Advanced Computing and Analysis Techniques in Physics Research, Daejeon (Korea, Republic of), 29 Nov-03 Dec 2021; ISSN 1742-6588
- Publisher:
- IOP PublishingCopyright Statement
- Country of Publication:
- United States
- Language:
- English
Similar Records
Integrated Scalable Parallel Firewall and Intrusion Detection System for High-Speed Networks
Protecting Websites from Cross-Site Scripting (XSS) Attacks: A Novel Configuration using Pulse Secure© Pulse Connect Secure© and Virtual Web Application Firewall (vWAF)