Application of business intelligence for analyzing vulnerabilities to increase the security level in an academic CSIRT
This study aimed at designing a potential solution through Business Intelligence for acquiring data and information from a wide variety of sources and utilizing them in the decision-making of the vulnerability analysis of an Academic CSIRT (Computer Security Incident Response Team). This study was d...
| Main Authors: | , , , , , |
|---|---|
| Format: | Online |
| Language: | eng |
| Published: |
Universidad Pedagógica y Tecnológica de Colombia
2018
|
| Subjects: | |
| Online Access: | https://revistas.uptc.edu.co/index.php/ingenieria/article/view/7747 |
| _version_ | 1801706081313882112 |
|---|---|
| author | Reyes-Mena, Francisco Xavier Fuertes-Díaz, Walter Marcelo Guzmán-Jaramillo, Carlos Enrique Pérez-Estévez, Ernesto Bernal-Barzallo, Paúl Fernando Villacís-Silva, César Javier |
| author_facet | Reyes-Mena, Francisco Xavier Fuertes-Díaz, Walter Marcelo Guzmán-Jaramillo, Carlos Enrique Pérez-Estévez, Ernesto Bernal-Barzallo, Paúl Fernando Villacís-Silva, César Javier |
| author_sort | Reyes-Mena, Francisco Xavier |
| collection | OJS |
| description | This study aimed at designing a potential solution through Business Intelligence for acquiring data and information from a wide variety of sources and utilizing them in the decision-making of the vulnerability analysis of an Academic CSIRT (Computer Security Incident Response Team). This study was developed in a CSIRT that gathers a variety of Ecuadorian universities. We applied the Action-Research methodology with a qualitative approach, divided into three phases: First, we qualitatively evaluated two intrusion detection analysis tools (Passive Scanner and Snort) to verify their advantages and their ability to be exclusive or complementary; simultaneously, these tools recorded the real-time logs of the incidents in a MySQL related database. Second, we applied the Ralph Kimball's methodology to develop several routines that allowed applying the "Extract, Transform, and Load" process of the non-normalized logs that were subsequently processed by a graphical user interface. Third, we built a software application using Scrum to connect the obtained logs to the Pentaho BI tool, and thus, generate early alerts as a strategic factor. The results demonstrate the functionality of the designed solution, which generates early alerts, and consequently, increases the security level of the CSIRT members. |
| format | Online |
| id | oai:oai.revistas.uptc.edu.co:article-7747 |
| institution | Revista Facultad de Ingeniería |
| language | eng |
| publishDate | 2018 |
| publisher | Universidad Pedagógica y Tecnológica de Colombia |
| record_format | ojs |
| spelling | oai:oai.revistas.uptc.edu.co:article-77472022-06-15T16:08:34Z Application of business intelligence for analyzing vulnerabilities to increase the security level in an academic CSIRT Aplicación de Inteligencia de Negocios para el análisis de vulnerabilidades en pro de incrementar el nivel de seguridad en un CSIRT académico Reyes-Mena, Francisco Xavier Fuertes-Díaz, Walter Marcelo Guzmán-Jaramillo, Carlos Enrique Pérez-Estévez, Ernesto Bernal-Barzallo, Paúl Fernando Villacís-Silva, César Javier business intelligence cybersecurity decision making early alerts electronic data processing ETL vulnerability analysis alertas tempranas análisis de vulnerabilidades ETL inteligencia de negocios procesamiento electrónico de datos seguridad cibernética toma de decisiones This study aimed at designing a potential solution through Business Intelligence for acquiring data and information from a wide variety of sources and utilizing them in the decision-making of the vulnerability analysis of an Academic CSIRT (Computer Security Incident Response Team). This study was developed in a CSIRT that gathers a variety of Ecuadorian universities. We applied the Action-Research methodology with a qualitative approach, divided into three phases: First, we qualitatively evaluated two intrusion detection analysis tools (Passive Scanner and Snort) to verify their advantages and their ability to be exclusive or complementary; simultaneously, these tools recorded the real-time logs of the incidents in a MySQL related database. Second, we applied the Ralph Kimball's methodology to develop several routines that allowed applying the "Extract, Transform, and Load" process of the non-normalized logs that were subsequently processed by a graphical user interface. Third, we built a software application using Scrum to connect the obtained logs to the Pentaho BI tool, and thus, generate early alerts as a strategic factor. The results demonstrate the functionality of the designed solution, which generates early alerts, and consequently, increases the security level of the CSIRT members. Esta investigación tuvo como objetivo diseñar una solución para la toma de decisiones mediante Inteligencia de Negocios, que permite adquirir datos e información de una amplia variedad de fuentes y utilizarlos en la toma de decisiones en el análisis de vulnerabilidades de un equipo de respuesta ante incidentes informáticos (CSIRT). Este estudio se ha desarrollado en un CSIRT Académico que agrupa varias universidades miembros del Ecuador. Para llevarlo a cabo se aplicó la metodología de Investigación-Acción con un enfoque cualitativo, dividido en tres fases: Primera, se realizó una evaluación comparativa de dos herramientas de análisis de intrusos: Passive Vulnerability Scanner y Snort, que son utilizadas por el CSIRT, para verificar sus bondades y verificar si son excluyentes o complementarias; enseguida se han guardado los logs en tiempo real de los incidentes registrados por dichas herramientas en una base de datos relacional MySQL. Segunda, se aplicó la metodología de Ralph Kimball para el desarrollo de varias rutinas que permitan aplicar el proceso “Extraer, Transformar y Cargar” de los logs no normalizados, que luego serían procesados por una interfaz gráfica. Tercera, se construyó una aplicación de software mediante la metodología Ágil Scrum, que realice un análisis inteligente con los logs obtenidos mediante la herramienta Pentaho BI, con el propósito de generar alertas tempranas como un factor estratégico. Los resultados muestran la funcionalidad de esta solución que ha generado alertas tempranas y que, en consecuencia, ha incrementado el nivel de seguridad de las universidades miembros del CSIRT académico. Universidad Pedagógica y Tecnológica de Colombia 2018-01-15 info:eu-repo/semantics/article info:eu-repo/semantics/publishedVersion research investigación application/pdf application/xml https://revistas.uptc.edu.co/index.php/ingenieria/article/view/7747 10.19053/01211129.v27.n47.2018.7747 Revista Facultad de Ingeniería; Vol. 27 No. 47 (2018); 21-29 Revista Facultad de Ingeniería; Vol. 27 Núm. 47 (2018); 21-29 2357-5328 0121-1129 eng https://revistas.uptc.edu.co/index.php/ingenieria/article/view/7747/6137 https://revistas.uptc.edu.co/index.php/ingenieria/article/view/7747/7182 Copyright (c) 2018 Francisco Xavier Reyes-Mena, Walter Marcelo Fuertes-Díaz, Carlos Enrique Guzmán-Jaramillo, Ernesto Pérez-Estévez, Paúl Fernando Bernal-Barzallo, César Javier Villacís-Silva |
| spellingShingle | business intelligence cybersecurity decision making early alerts electronic data processing ETL vulnerability analysis alertas tempranas análisis de vulnerabilidades ETL inteligencia de negocios procesamiento electrónico de datos seguridad cibernética toma de decisiones Reyes-Mena, Francisco Xavier Fuertes-Díaz, Walter Marcelo Guzmán-Jaramillo, Carlos Enrique Pérez-Estévez, Ernesto Bernal-Barzallo, Paúl Fernando Villacís-Silva, César Javier Application of business intelligence for analyzing vulnerabilities to increase the security level in an academic CSIRT |
| title | Application of business intelligence for analyzing vulnerabilities to increase the security level in an academic CSIRT |
| title_alt | Aplicación de Inteligencia de Negocios para el análisis de vulnerabilidades en pro de incrementar el nivel de seguridad en un CSIRT académico |
| title_full | Application of business intelligence for analyzing vulnerabilities to increase the security level in an academic CSIRT |
| title_fullStr | Application of business intelligence for analyzing vulnerabilities to increase the security level in an academic CSIRT |
| title_full_unstemmed | Application of business intelligence for analyzing vulnerabilities to increase the security level in an academic CSIRT |
| title_short | Application of business intelligence for analyzing vulnerabilities to increase the security level in an academic CSIRT |
| title_sort | application of business intelligence for analyzing vulnerabilities to increase the security level in an academic csirt |
| topic | business intelligence cybersecurity decision making early alerts electronic data processing ETL vulnerability analysis alertas tempranas análisis de vulnerabilidades ETL inteligencia de negocios procesamiento electrónico de datos seguridad cibernética toma de decisiones |
| topic_facet | business intelligence cybersecurity decision making early alerts electronic data processing ETL vulnerability analysis alertas tempranas análisis de vulnerabilidades ETL inteligencia de negocios procesamiento electrónico de datos seguridad cibernética toma de decisiones |
| url | https://revistas.uptc.edu.co/index.php/ingenieria/article/view/7747 |
| work_keys_str_mv | AT reyesmenafranciscoxavier applicationofbusinessintelligenceforanalyzingvulnerabilitiestoincreasethesecuritylevelinanacademiccsirt AT fuertesdiazwaltermarcelo applicationofbusinessintelligenceforanalyzingvulnerabilitiestoincreasethesecuritylevelinanacademiccsirt AT guzmanjaramillocarlosenrique applicationofbusinessintelligenceforanalyzingvulnerabilitiestoincreasethesecuritylevelinanacademiccsirt AT perezestevezernesto applicationofbusinessintelligenceforanalyzingvulnerabilitiestoincreasethesecuritylevelinanacademiccsirt AT bernalbarzallopaulfernando applicationofbusinessintelligenceforanalyzingvulnerabilitiestoincreasethesecuritylevelinanacademiccsirt AT villacissilvacesarjavier applicationofbusinessintelligenceforanalyzingvulnerabilitiestoincreasethesecuritylevelinanacademiccsirt AT reyesmenafranciscoxavier aplicaciondeinteligenciadenegociosparaelanalisisdevulnerabilidadesenprodeincrementarelniveldeseguridadenuncsirtacademico AT fuertesdiazwaltermarcelo aplicaciondeinteligenciadenegociosparaelanalisisdevulnerabilidadesenprodeincrementarelniveldeseguridadenuncsirtacademico AT guzmanjaramillocarlosenrique aplicaciondeinteligenciadenegociosparaelanalisisdevulnerabilidadesenprodeincrementarelniveldeseguridadenuncsirtacademico AT perezestevezernesto aplicaciondeinteligenciadenegociosparaelanalisisdevulnerabilidadesenprodeincrementarelniveldeseguridadenuncsirtacademico AT bernalbarzallopaulfernando aplicaciondeinteligenciadenegociosparaelanalisisdevulnerabilidadesenprodeincrementarelniveldeseguridadenuncsirtacademico AT villacissilvacesarjavier aplicaciondeinteligenciadenegociosparaelanalisisdevulnerabilidadesenprodeincrementarelniveldeseguridadenuncsirtacademico |
