Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Hardware for SIEM sy ...

 Business

At some point, the information security department of any large company inevitably begins to consider introducing a SIEM system — or replacing the existing one, and must therefore estimate the budget required for its deployment. But SIEM isnt a lightweight product that can be deployed within existing infrastructure.   show more ...  

Almost all solutions in this category require additional hardware, meaning that equipment must be purchased or rented. So, for accurate budgeting, its necessary to take into account the expected hardware configuration. In this post, we discuss how SIEM hardware requirements change depending on the companys profile and systems architecture, and provide rough parameters to help estimate the preliminary cost of such equipment. Evaluating the data flow Essentially, a SIEM system collects event data from internal and external sources and identifies security threats by correlating this data. Therefore, before considering what hardware will be required, its essential to first assess the volume of information the system will process and store. To this end, you need to first identify critical risks to the infrastructure, and then determine the data sources that must be analyzed to help detect and address threats related to these risks. These are the data sources to focus on. Such an assessment is necessary not only to determine the required hardware, but also to estimate the cost of licensing. For example, the cost of licensing for our Kaspersky Unified Monitoring and Analysis Platform SIEM system directly depends on the number of events per second (EPS). Another important aspect is to check how the vendor calculates the number of events for licensing. In our case, we take the events per second after filtering and aggregation, calculating the average number of events over the past 24 hours rather than their peak values — but not all vendors follow this approach. The most common sources include endpoints (Windows events, Sysmon, PowerShell logs, and antivirus logs), network devices (firewalls, IDS/IPS, switches, access points), proxy servers (such as Squid and Cisco WSA), vulnerability scanners, databases, cloud systems (such as AWS CloudTrail or Office 365), and infrastructure management servers (domain controllers, DNS servers, and so on). As a rule, to form preliminary expectations about the average event flow, the size of the organization can serve as a guide. However, the architectural particularities of specific IT infrastructure can make company size a less decisive parameter. In general, for small and medium-sized organizations with just one office — or up to several offices with good communication channels among them and IT infrastructure located in a single data center — an average event flow of 5000–10 000 EPS can be expected. For large companies, making an estimate is more challenging: depending on the complexity of the infrastructure and the presence of branches, EPS can range from 50 000 to 200 000 EPS. Architectural components of an SIEM system An SIEM system generally consists of four main components: the management subsystem, event collection subsystem, correlation subsystem, and storage subsystem. Core (management subsystem). You can think of this as the control center of the system. It allows managing the other components, and provides visualization tools for SOC analysts — enabling them to easily configure operational parameters, monitor the SIEM systems state, and, most importantly, view, analyze, sort and search events, process alerts, and work with incidents. This control center needs to also support log viewing through widgets and dashboards, and enable quick data search and access. The core is an essential component and can be installed as a single instance or as a cluster to provide a higher level of resilience. Event collection subsystem. As the name suggests, this subsystem collects data from various sources and converts it into a unified format through parsing and normalization. To calculate the required capacity of this subsystem, one must consider both the event flow intensity and the log format in which events arrive from sources. The server load depends on how the subsystem processes logs. For example, even for structured logs (Key Value, CSV, JSON, XML), you can use either regular expressions (requiring significantly more powerful hardware) or the vendors built-in parsers. Correlation subsystem. This subsystem analyzes data collected from logs, identifies sequences described in correlation rule logic, and, if necessary, generates alerts, determines their threat levels, and minimizes false positives. Its important to remember that the correlators load is also determined not only by the event flow but by the number of correlation rules and the methods used to describe detection logic as well. Storage subsystem. An SIEM system must not only analyze but also store data for internal investigations, analytics, visualization and reporting, and in certain industries — for regulatory compliance and retrospective alert analysis. Thus, another critical question at the SIEM system design stage is how long you want to store collected logs. From an analysts perspective, the longer the data is stored, the better. However, a longer log retention period increases hardware requirements. A mature SIEM system provides the ability to strike a balance by setting different retention periods for different log types. For example, 30 days for NetFlow logs, 60 days for Windows informational events, 180 days for Windows authentication events, and so on. This allows data to be optimally allocated across available server resources. Its also important to understand what volume of data will be stored using hot storage (allowing quick access) and cold storage (suitable for long-term retention). The storage subsystem must offer high performance, scalability, cross-storage search capabilities (both hot and cold), and data viewing options. Additionally, the ability to back up stored data is essential. Architectural features of Kaspersky SIEM So, weve laid out the ideal requirements for an SIEM system. It probably wont surprise you that our Kaspersky Unified Monitoring and Analysis Platform meets these requirements. With its built-in capability to scale for data flows reaching hundreds of thousands of EPS within a single instance, our SIEM system isnt afraid of high loads. Importantly, it doesnt need to be split into multiple instances with correlation results reconciled afterwards — unlike many alternative systems. The event collection subsystem of the Kaspersky Unified Monitoring and Analysis Platform system is equipped with a rich set of parsers optimized for processing logs in each format. Additionally, the multi-threading capabilities of Go mean the event flow can be processed using all available server resources. The data storage subsystem used in our SIEM system consists of servers that store data, and servers with the clickhouse-keeper role, which manage the cluster (these servers dont store data themselves but facilitate coordination among instances). For data flows of 20 000 EPS with a relatively low number of search queries, these services can operate on the same servers that store the data. For higher data flows, its recommended to separate these services. For instance, they can be deployed on virtual machines (a minimum of one is required, though three are recommended). The Kaspersky Unified Monitoring and Analysis SIEM storage system is flexible — allowing event flows to be distributed across multiple spaces, and specifying the storage depth for each space. For example, inexpensive disks can be used to create cold storage (where searches are still possible, just slower). This cold storage can house data that is unlikely to require analysis but must be stored due to regulatory requirements. Such information can be moved to cold storage literally the day after its collected. Thus, the data storage approach implemented in our SIEM system enables long-term data retention without exceeding the budget on expensive equipment, thanks to hot and cold storage capabilities. SIEM architecture deployment using our SIEM as an example The Kaspersky Unified Monitoring and Analysis Platform supports multiple deployment options, so its important first to determine your organizations architecture needs. This can be done based on the estimated EPS flow, and the particularities of your company. For simplicity, lets assume the required data retention period is 30 days. Data flow: 5000–10 000 EPS For a small organization, the SIEM system can be deployed on a single server. For example, our SIEM system supports the All-in-One installation option. In this case, the required server configuration is 16 CPUs, 32GB of RAM, and a 2.5TB of disk space. Data flow: 30 000 EPS For larger organizations, separate servers are needed for each SIEM component. Dedicating a server exclusively for storage ensures that search queries dont affect the processing of events by the collector and correlator. However, the collector and correlator services can still be deployed together (or separately, if desired). An approximate equipment configuration for this scenario is as follows: Core: 10 CPUs, 24GB of RAM, 0.5TB of disk space Collector: 8 CPUs, 16GB of RAM, 0.5TB of disk space Correlator: 8 CPUs, 32GB of RAM, 0.5TB of disk space Storage: 24 CPUs, 64GB of RAM, 14TB of disk space Data flow: 50 000–200 000 EPS For large enterprises, additional factors must be considered when defining the architecture. These include ensuring resilience (as the substantial data-flow increases the risk of failure) and the presence of company divisions (branches). In such cases, more servers may be required to install the SIEM system, as its preferable to distribute collector and correlator services across different servers for such high EPS flows. Data flow: 200 000 EPS As EPS flows grow and the infrastructure divides into separate independent units, the amount of equipment required increases accordingly. Additional servers will be needed for collectors, storage, correlators, and keepers. Moreover, in large organizations, data availability requirements may take precedence. In this case, the Kaspersky Unified Monitoring and Analysis Platform storage cluster divides all collected events into shards. Each shard consists of one or more data replicas. And each shard replica is a cluster node, meaning a separate server. To ensure resilience and performance, we recommend deploying the cluster with two replicas per shard. For processing such large EPS volumes, three collector servers may be required, installed in the offices with the highest event flows. Kaspersky SIEM in holding companies In large enterprises, the cost of implementing an SIEM system increases not only with the volume of data, but also depending on the usage profile. For example, in some cases (such as MSP and MSSP environments, as well as large holding companies with multiple subsidiaries or branches), multi-tenancy is required. This means the company needs to maintain multiple mini-SIEMs, which operate independently. Our solution enables this through a single installation at the head office, without the need to install separate systems in/at each branch/tenant. This significantly reduces equipment costs. Lets imagine either (i) a holding company, (ii) a vertically-integrated enterprise, or (iii) a geographically-distributed corporation with either various independent security teams or a need to isolate data access among branches. The Kaspersky Unified Monitoring and Analysis Platform tenant model allows for segregated access to all resources, events, and third-party integration settings. This means one installation functions as multiple separate SIEM systems. In this case, while each tenant can develop its own content (correlation rules), theres also the option of distributing a unified set of resources across all divisions. In other words, each division can have its own collectors, correlators, and rules, but the HQ security team can also assign standardized bundles of security content for everyone — ensuring consistent protection across the organization. Thus, using the Kaspersky Unified Monitoring and Analysis Platform ensures the necessary performance with relatively modest computing resources. In some cases, savings on hardware can reach up to 50%. For a more accurate understanding of the required resources and implementation costs, we recommend talking with our specialists or integration partners. We (or our partners) can also provide premium support, assist in developing additional integrations (including using API capabilities for connected products), and oversee the deployment of a turnkey solution covering system design, equipment estimation, configuration optimization, and much more. Learn more about our SIEM system, the Kaspersky Unified Monitoring and Analysis Platform, on the official product page.

image for LockBit Ransomware D ...

 Feed

Dual Russian-Israeli national Rostislav Panev was arrested last August and is facing extradition to the US for playing a critical role in LockBit's RaaS activities, dating back to the ransomware gang's origins.

 Feed

A now-patched critical security flaw impacting Fortinet FortiClient EMS is being exploited by malicious actors as part of a cyber campaign that installed remote desktop software such as AnyDesk and ScreenConnect.  The vulnerability in question is CVE-2023-48788 (CVSS score: 9.3), an SQL injection bug that allows attackers to execute unauthorized code or commands by sending specially crafted

 Feed

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical security flaw impacting BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) products to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The vulnerability, tracked as CVE-2024-12356 (CVSS score: 9.8), is a command injection flaw that

 Feed

The developers of Rspack have revealed that two of their npm packages, @rspack/core and @rspack/cli, were compromised in a software supply chain attack that allowed a malicious actor to publish malicious versions to the official package registry with cryptocurrency mining malware. Following the discovery, versions 1.1.7 of both libraries have been unpublished from the npm registry. The latest

 Feed

Sophos has released hotfixes to address three security flaws in Sophos Firewall products that could be exploited to achieve remote code execution and allow privileged system access under certain conditions. Of the three, two are rated Critical in severity. There is currently no evidence that the shortcomings have been exploited in the wild. The list of vulnerabilities is as follows -

 Feed

The Lazarus Group, an infamous threat actor linked to the Democratic People's Republic of Korea (DPRK), has been observed leveraging a "complex infection chain" targeting at least two employees belonging to an unnamed nuclear-related organization within the span of one month in January 2024. The attacks, which culminated in the deployment of a new modular backdoor referred to as CookiePlus, are

 Feed

Take a peek into the murky world of cybercrime where groups of scammers who go by the nickname of 'Neanderthals’ wield the Telekopye toolkit to ensnare unsuspecting victims they call 'Mammoths'

 0CISO2CISO

Source: www.schneier.com – Author: Bruce Schneier Menu Blog Newsletter Books Essays News Talks Academic About Me HomeBlog Mailbox Insecurity It turns out that all cluster mailboxes in the Denver area have the same master key. So if someone robs a postal carrier, they can open any mailbox. I get that a single   show more ...  

master key makes […] La entrada Mailbox Insecurity – Source: www.schneier.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Waqas. KEY SUMMARY POINTS Krispy Kreme Data Breach: The notorious Play ransomware group has claimed responsibility for the data breach at Krispy Kreme and is threatening to leak the data within two days. Threatening to Leak Data: Hackers threaten to leak sensitive company data   show more ...  

within two days. Play Ransomware and Doube […] La entrada Play Ransomware Claims Krispy Kreme Breach, Threatens Data Leak – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Sharing a few highlights from the WE24 conference held at McCormick Place.  Source Views: 0 La entrada SWE Shares First Conference Sustainability Report se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Becky Bracken, Senior Editor, Dark Reading Source: Constantine Johnny via Alamy Stock Photo NEWS BRIEF Operational technology (OT) and Industrial control systems (ICS) are increasingly exposed to compromise through engineering workstations. A new malware developed to kill   show more ...  

stations running Siemens systems joins a growing list of botnets and worms working to […] La entrada OT/ICS Engineering Workstations Face Barrage of Fresh Malware – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Tara Seals, Managing Editor, News, Dark Reading Source: Konstantin Nechaev via Alamy Stock Photo NEWS BRIEF Fortinet has finally patched a critical security vulnerability in its Wireless LAN Manager (FortiWLM) that could allow unauthenticated sensitive information   show more ...  

disclosure. And, when chained with another issue, it could lead to remote code execution (RCE), […] La entrada Fortinet Addresses Unpatched Critical RCE Vector – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Nate Nelson, Contributing Writer Source: ZUMA Press, Inc. via Alamy Stock Photo A critical, stubborn new vulnerability in Apache Struts 2 may be under active exploitation already, and fixing it isn’t as simple as downloading a patch. Struts 2 is an open source   show more ...  

framework for building Java applications. Though long past […] La entrada Orgs Scramble to Fix Actively Exploited Bug in Apache Struts 2 – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Bridging

Source: www.darkreading.com – Author: Joan Goodchild Source: Carlos Castilla via Alamy Stock Photo Just about everyone is familiar with the annoying process of becoming locked out of an account and needing to reset a password. Whether it’s forgetting a log-in after months of disuse or being forced to   show more ...  

prove your identity to regain access, the […] La entrada Bridging the ‘Keyboard-to-Chair’ Gap With Identity Verification – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Jeffrey Schwartz Source: Poptika via Shutterstock When industrial automation giant Schneider Electric revealed last month that ransomware gang Hellcat stole 40GB of sensitive data, the attackers acknowledged using exposed credentials to breach Schneider’s Jira   show more ...  

server.  Once inside the company’s project management system, attackers used the miniOrange REST API, a widely used authentication plug-in, […] La entrada Vendors Chase Potential of Non-Human Identity Management – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Jai Vijayan, Contributing Writer Source: Bits And Splits via Shtterstock Threat actors appear to have found yet another innovative use case for artificial intelligence in malicious campaigns: to create decoy ads for fooling malvertising-detection engines on the Google Ads   show more ...  

platform. The scam involves attackers buying Google Search ads and using AI […] La entrada Malvertisers Fool Google With AI-Generated Decoy Content – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Rob T. Lee Rob T. Lee, Chief of Research & Head of Faculty, SANS Institute December 19, 2024 5 Min Read Source: Michael Burrell via Alamy Stock Photo COMMENTARY Israel’s electronic pager attacks targeting Hezbollah in September highlighted the dangerous   show more ...  

ramifications of a weaponized supply chain. The attacks, which leveraged remotely detonated explosives […] La entrada Supply Chain Risk Mitigation Must Be a Priority in 2025 – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini Pierluigi Paganini December 19, 2024 Juniper Networks warns that a Mirai botnet is targeting SSR devices with default passwords after unusual activity was reported on December 11, 2024. Juniper Networks is warning that a Mirai botnet is targeting Session   show more ...  

Smart Router (SSR) products with default passwords. Multiple customers reported […] La entrada Mirai botnet targets SSR devices, Juniper Networks warns – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: Ionut Arghire The Play ransomware group has claimed responsibility for the cyberattack that disrupted operations at donut and coffee retail chain Krispy Kreme last week. The incident occurred on November 29, the North Carolina company said in a regulatory filing with the   show more ...  

Securities and Exchange Commission (SEC) last week. “Krispy Kreme […] La entrada Ransomware Group Claims Theft of Personal, Financial Data From Krispy Kreme – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: Eduard Kovacs A Romanian national accused of conducting cyberattacks using the NetWalker ransomware has been sentenced to 20 years in prison in the United States, the Justice Department announced on Thursday. In addition to the prison sentence, the man, 30-year-old Daniel   show more ...  

Christian Hulea, has been ordered to pay nearly $15 million […] La entrada Another NetWalker Ransomware Affiliate Gets 20-Year Prison Sentence in US – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BeyondTrust

Source: www.securityweek.com – Author: Ionut Arghire The US cybersecurity agency CISA warns that a recently disclosed vulnerability in BeyondTrust’s remote access products has been exploited in the wild. The issue, tracked as CVE-2024-12356 (CVSS score of 9.8), is a command injection bug impacting BeyondTrust   show more ...  

Privileged Remote Access (PRA) and Remote Support (RS) that can be […] La entrada CISA Urges Immediate Patching of Exploited BeyondTrust Vulnerability – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: Eduard Kovacs Critical vulnerabilities patched by Rockwell Automation in its Allen-Bradley PowerMonitor 1000 product could allow remote hackers to breach an organization’s industrial systems and cause disruption or gain further access.  The existence of the   show more ...  

vulnerabilities came to light this week when Rockwell Automation and the cybersecurity agency CISA released security […] La entrada Rockwell PowerMonitor Vulnerabilities Allow Remote Hacking of Industrial Systems – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: Matias Madou Vulnerabilities introduced from third-party components continue to create major issues for organizations: Nearly all codebases, for example, contain open-source components, and 77 percent of all code in codebases originates from open source. Yet, open   show more ...  

source-linked vulnerabilities exist in 84 percent of risk-assessed codebases, with 74 percent of the codebases […] La entrada How to Implement Impactful Security Benchmarks for Software Development Teams – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 China

Source: www.securityweek.com – Author: Ionut Arghire The US cybersecurity agency CISA on Wednesday released guidance for highly targeted individuals to protect their mobile communications against exploitation from threat actors. The document was published as reaction to a recent telecom hacking campaign that   show more ...  

targeted large wireless carriers in the US, including Verizon, AT&T, Lumen Technologies, and […] La entrada CISA Releases Mobile Security Guidance After Chinese Telecom Hacking – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Source: www.securityweek.com – Author: Ionut Arghire The US Department of Justice on Wednesday announced the sentencing of a Ukrainian national for his role in the distribution of the Raccoon Infostealer malware. The man, Mark Sokolovsky, 28, was arrested in March 2022 in the Netherlands, after the FBI and law   show more ...  

enforcement agencies in Italy and the […] La entrada Ukrainian Raccoon Infostealer Operator Sentenced to Prison in US – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Waqas. KEY SUMMARY POINTS Arrest of Rostislav Panev: Dual Russian-Israeli national Rostislav Panev, a key developer for the LockBit ransomware group, was arrested in Israel in August and awaits extradition to the U.S. Role in LockBit Operations: Panev allegedly developed and   show more ...  

maintained malware infrastructure for LockBit, enabling affiliates to launch ransomware […] La entrada LockBit Developer Rostislav Panev, a Dual Russian-Israeli Citizen, Arrested – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2024-12
Aggregator history
Friday, December 20
SUN
MON
TUE
WED
THU
FRI
SAT
DecemberJanuaryFebruary