System Responsive to ICT Security Incidents in the LAN

Abstract

The system responsive to ICT security incidents in the LAN is presented. The system is implemented in the Industrial Research Institute for Automation and Measurements PIAP, Poland. In everyday practice, while processing of information, it is necessary to deal with IT security incidents. They are single events or series of events related to the security of classified information. They threaten the confidentiality, availability and integrity of information. Implementation of the system required the following steps: choice of the sources of information based on which assessment of the level of threats will be carried out, definition of the method of analysis of data from the chosen sources of information, definition of a single, common storage of information about threats, realization of the feedback which will introduce modifications in the router in order to counteract threats. For the sources of information were selected: continuously recorded packet flows from CISCO router, information from RBL servers, web server logs and current behavior of LAN, observed by the system administrator. The methods of data analysis included: threat assessment based on the analysis of flows in the router, assessment of the level of threats based on a web server log analysis and assessment of risks in router and web server based on information from the RBL servers. For storage of data coming from sources of information, the MySQL database was used. The essence of feedback is a self-acting modification of Access Control List (ACL) on the CISCO router. As a result of the research work, the system was implemented which attempts to automatically remove LAN security threats.