|
|
Analysis and design of an effective solution for integration of Web Application Firewall into SOC architecture
Hynek, Vojtěch ; Komosný, Dan (referee) ; Kubánková, Anna (advisor)
The thesis deals with the issue of integration of Web Application Firewall into the environment of Supervisory Security Center. The result of this thesis is an analysis of current integration options along with identification of the most common attacks on web applications. Using the analysis performed, the best suited WAF was selected along with its integration method. Furthermore, the thesis contains a detailed description of the chosen integration and its subsequent testing. Testing of the correctness of the firewall, its stress testing and its effect on the network delay was performed. A part of the thesis also describes the integration of WAF into a real SOC environment. The integration involves connection to log management and traffic monitoring technologies. At the same time, a custom integration with the MISP platform has been developed, which makes it possible to create dynamic rules for the WAF. The integration includes the creation of a custom parser, correlation rules and a test scenario. The last part of the thesis is devoted to the analysis of the impact of the WAF integration on the prevention and detection of cyber threats, which includes an evaluation of the emerging alerts over a period of one month.
|
|
|
DNS firewall and its deployment and integration in cyber center
Doležal, Martin ; Kubánková, Anna (referee) ; Jeřábek, Jan (advisor)
This bachelor's thesis deals with the deployment, integration, and testing of a DNS firewall in a security operations center. It describes the connection of endpoints and remote local area networks to the DNS firewall located in the security operations center. Furthermore, the enforcement of the DNS firewall is described. The main goal of the thesis was to deploy and integrate a DNS firewall inside a security operations center. The first chapter describes the security operations center in general. The second chapter deals with the DNS system. The following chapter describes the security of the DNS system and security of DNS requests, the reader is informed of the term DNS firewall and RPZ and VPN technologies. The fourth chapter describes the DNS firewall deployment process and its integration in a real security operations center. The next chapter describes connection methods of endpoint and remote local area networks to the DNS firewall and its enforcement inside the security operations center. The last chapter deals with performance testing and deployed DNS firewall availability. The outcome of the thesis involves a deployed, integrated, fully-functional, and tested DNS firewall in a real-world security operations center. The Bind software package along with the RPZ technology was used to implement and deploy the DNS firewall. For testing and connection of endpoints, the VPN technology, and the RIPE Atlas network was used.
|
|
|
DNS firewall and its deployment and integration in cyber center
Doležal, Martin ; Kubánková, Anna (referee) ; Jeřábek, Jan (advisor)
This bachelor's thesis deals with the deployment, integration, and testing of a DNS firewall in a security operations center. It describes the connection of endpoints and remote local area networks to the DNS firewall located in the security operations center. Furthermore, the enforcement of the DNS firewall is described. The main goal of the thesis was to deploy and integrate a DNS firewall inside a security operations center. The first chapter describes the security operations center in general. The second chapter deals with the DNS system. The following chapter describes the security of the DNS system and security of DNS requests, the reader is informed of the term DNS firewall and RPZ and VPN technologies. The fourth chapter describes the DNS firewall deployment process and its integration in a real security operations center. The next chapter describes connection methods of endpoint and remote local area networks to the DNS firewall and its enforcement inside the security operations center. The last chapter deals with performance testing and deployed DNS firewall availability. The outcome of the thesis involves a deployed, integrated, fully-functional, and tested DNS firewall in a real-world security operations center. The Bind software package along with the RPZ technology was used to implement and deploy the DNS firewall. For testing and connection of endpoints, the VPN technology, and the RIPE Atlas network was used.
|
guest ::
