Security Correlation Server System Deployment and Planning Guide

Transcription

1 CorreLog Security Correlation Server System Deployment and Planning Guide The CorreLog Server provides a method of collecting security information contained in log messages generated by network devices and applications. These messages are then correlated into understandable threads, alerts, and actions, and reduced to actionable "tickets" that are sent to users. Using this functionality, CorreLog Server system provides special application in security monitoring of an enterprise, and furnishes a variety of special features to support this critical role, including data encryption, ready-to-run correlation rules and TCP tunneling software. Other roles of CorreLog, including performance management, analysis of business information, and log file analysis are also supported within the product. This particular guide, presented here, provides information useful for estimating workloads for various types of CorreLog configurations, as a beginning point for small, medium, or large-scale deployments of the system. This information is intended for use by CorreLog administrators, project managers, and personnel responsible for implementing the CorreLog Server software with an enterprise. In addition to serving as the basis for a deployment, this guide includes best-practices information. Although an enterprise may not fit any of the precise deployment strategies listed in this document, easy synthesis of a strategy can be made through a combination of the several typical methodologies referenced here. CorreLog provides additional information in the form of an installation guide, hardware and software requirements datasheets, as well as information available from CorreLog support and professional services. The user can obtain background information on the CorreLog Server, agents, and functionality from the "Home" page of the CorreLog web interface after installation, and from the CorreLog corporate website.

2 Deployment Project Strategy Various methodologies exist for planning and deploying CorreLog, either as a standalone system, or as a large distributed system. For small deployments, the administrator can take an "ad hoc" approach (due to the easy nature of CorreLog installation and configuration.) However, for larger deployments, CorreLog recommends a standard planning and deployment cycle, such as that found in IEEE/EIA (Standard for Information Technology Software Life Cycle Processes). Irrespective of the actual methodology selected by a project manager, a CorreLog deployment will always consist of the following basic activities. Requirement Definition Requirement definition establishes a baseline of what is to be accomplished, and serves as a starting point to the deployment life cycle. This activity requires knowledge of the types of devices and applications to be managed, knowledge of the network structure (including security functions such as access through firewalls and gateways) as well as analysis of required resources. In some cases, this deployment phase may be executed quickly, however many large deployments may require detailed requirement analysis. Design and Resource Allocation The Design and Resource Allocation project phase specifies the architecture of the deployment, including selection of a "Deployment Type" (as discussed in later sections.) This phase also includes selection of target devices, allocation of bandwidth and disk space, and determination of the physical personnel required to perform the deployment. This design phase will determine physical aspects such as the IP addresses of CorreLog servers, and selection of locations for CorreLog Tunneling processes (if needed.) The standard "CorreLog Installation Guide" may be used to resolve specific design issues. Physical Deployment The Physical Deployment phase of the project will consist of actually installing and configuring the system, and may be the most time-consuming phase of the project. The level-of-effort associated with the physical deployment (based upon type of deployment) can be estimate from the tables and formulas presented in later sections. This project phase will require administrative access and oversight; including the ability to modify firewall configurations (if necessary) and the permissions necessary to install new software on managed platforms. Operational Test And Training The final project phase of the project consists of validation testing, and may include formal training. This phase may include creation of documentation specific for the enterprise. This phase typically consists of migrating the CorreLog deployment into production, where further configuration and ongoing adaptation may be necessary by administrators and operators (detailed in later sections.) Deployment Guide, Page 2

3 Deployment Resource Requirements During the requirements phase of the deployment, specific requirements must be established for each of the areas below. Hardware Requirements CorreLog operates on a variety of hardware systems, and interoperates with even a larger variety of hardware. The requirements phase of the project will establish the particular computer systems needed to support the deployment, including disk space, network interface, and security (firewall) requirements. The "CorreLog Installation Guide" will be useful in determining hardware requirements based upon the type of implementation. Software Requirements CorreLog operates with a variety of different software systems and applications. The requirements phase defines the requirements including specific operating systems, application API's (if needed), extra integration software that is available from CorreLog or from third-party vendors, and database requirements. Installation Personnel The requirements phase identifies the number of people required to actually install the software. In the case of single-tier deployments, this will often be the same person as the administrator of the CorreLog system and the system operator. In the case of larger deployments, this may require coordination of multiple installers, possibly located in dispersed geographical locations. Installation workload is specified in subsequent tables of this document Administrative Personnel The requirements phase identifies system administrators who will be responsible for the configuration, the periodic maintenance required by CorreLog, and special configuration associated with granting access to the CorreLog server. Administrative workload is specified in subsequent tables of this document. Operations Personnel The requirements phase identifies actual operators who will be responsible for the daily operations of the program. These will be the end-users of the system, who will be responsible for the system workflow, analysis and closure of tickets, as well as collection distribution and of reports. Operation workload is specified in subsequent tables of this document. The requirements phase may also identify additional required personnel and resources, such as analysts and security officers participating in the project, as well as liaison to third-party vendors (such as incident management systems and other application software.) Deployment Guide, Page 3

4 Deployment Types CorreLog can operate in various modes, including stand-alone, single-tier, and multiple tier configurations. The particular deployment type will govern the level-of-effort needed to deploy and operate the system, ranging from a simple "unattended" mode of operation to large enterprise management of a million individual devices or more. The deployment type is typically selected during the "Design Phase" of the program (discussed previously) based upon the organization's specific objectives. Small Single-Tier Installation (One CorreLog Server, 5 to 100 managed nodes) This type of deployment consists of a single copy of CorreLog Server, managing 5 to 100 different nodes, such as might be found in an office place, or a small business, or a single department. This type of installation will typically be a manual deployment, performed by a single administrator, with management and operational activities absorbed by a single person. Large Single-Tier Installation (One CorreLog Server, 100 to 30,000 managed nodes) This type of deployment consists of a single copy of CorreLog Server, managing large numbers of different nodes, such as might be found in a small or medium business spanning various offices and departments. This type of installation will typically be a manual deployment of the CorreLog server, with an automated deployment agents, performed by one or two administrators, with management and operational activities absorbed by a single person as a full time activity. Small, Two-Tier Deployment (2 to 100 CorreLog Servers, 200 to 100,000 managed nodes) This type of deployment consists of a small number of individual CorreLog Servers, each managing small to large numbers of different nodes, as might be found in a medium to large business spanning various offices and geographical locations. This type of installation will typically be a manual deployment of the CorreLog server, with automated deployment of agents, performed by multiple administrators, and requiring multiple operators. Large, Two-Tier Deployment (100 to 30,000 CorreLog Servers, 200 to 1,000,000+ managed nodes) This type of deployment consists of a large number of CorreLog Servers, each managing small to large numbers of different nodes, as might be found in a large enterprise spanning many offices and geographical locations. This type of installation will typically consist of an automated deployment of CorreLog Servers, with automated deployment of agents, performed by multiple administrators, with management and operational activities performed by multiple full-time administrators and operators Deployment Guide, Page 4

5 Small Single-Tier Installation Workload Estimation (5 to 100 managed nodes, one CorreLog Server) Hours To Install Approximately 0.1 hours for server Hours Per managed node. Example: A 10-node implementation will typically take about 1 hour to install. Hours To Initially Configure Approximately 0.2 hours per managed node Example: A 10-node implementation will typically require about 2 hours to initially configure. Administrative Workload Less than one hour per week. Operational Workload Between 0.5 and 2 hours per day to resolve open tickets. Special Considerations A single administrator typically performs deployment and configuration, and will absorb the administrative and operational workload as a part of their normal operations. This model can be generalized to a distributed architecture as outlined below, and can serve as the worst-case workload for that type of system. For example, without leveraging any "economy of scale", a distributed system consisting of 10 CorreLog servers, each managing ten devices, will require 10 hours to initially deploy and configure. (More efficient deployments are outlined in subsequent tables.) Deployment Guide, Page 5

6 Large Single-Tier Installation Workload Estimation (100 to 30,000 managed nodes, one CorreLog Server) Hours To Install Approximately 0.1 hours for server + 4 hours to configure and implement automated deployment hour for each device that cannot be remotely configured. Example: A 1000-node implementation will typically require about 8 hours to install. Hours To Initially Configure Approximately 1 hours to create remote configuration batch files for each managed device type. Approximately 0.1 hours per managed node that is manually configured + time to execute remote configuration batch files. Example: A 1000 node implementation consisting of 5 different types of uniform devices will typically require about 5 hours to configure. Administrative Workload Approximately 1 hour per week administrative activities. Operational Workload Between 0.5 and 2 hours per day to resolve open tickets, depending upon amount of data collected. Special Considerations Installation of agents relies mainly upon automated deployment software supplied by the customer. Initial configuration is accomplished by CorreLog "remote configuration" utilities, executed in batch mode. Deployment Guide, Page 6

7 Small, Two-Tier Deployment Workload Estimation (200 to 100,000 managed nodes, with 2 to 100 CorreLog Servers) Hours To Install Approximately 0.1 hours for server + 4 hours to configure and implement automated deployment hour for each device that cannot be remotely installed. Example: A 10,000-node implementation consisting of three different CorreLog Servers will typically require about 24 hours to install. Hours To Initially Configure Approximately 1 hours to create remote configuration batch files for each managed device type. Approximately 0.1 hours per managed node that is manually configured + time to execute remote configuration batch files. Approximately 1-hour special configuration for each CorreLog Server. Example: A 10,0000-node implementation consisting of 5 different types of uniform devices, managed by three different CorreLog Servers, will typically require take about 8 hours to initially configure. Administrative Workload Approximately 2 hours per week administrative activities, per CorreLog Server implementation Operational Workload Approximately 2 hours per day per CorreLog Server to resolve open tickets, depending upon amount of data collected. Special Considerations Installation and initial configuration of CorreLog Servers are performed manually. Installation of agents relies mainly upon automated deployment software supplied by the customer. Initial configuration is accomplished by CorreLog remote configuration utilities. Deployment Guide, Page 7

8 Large, Two-Tier Deployment Workload Estimation (200 to 1,000,000+ nodes, with 100 to 30,000 CorreLog Servers) Hours To Install Approximately 8 hours to configure and implement automated deployment of CorreLog Servers + 8 hours to configure and implement automated deployment hour for each device that cannot be remotely installed. Example: A 100,0000-node implementation consisting of 10 different types of uniform devices, managed by 100 different CorreLog Servers, will typically require about 24 hours to install + actual execution time. Hours To Initially Configure Approximately 1 hours to create remote configuration batch files for each managed device type. Approximately 1 hour special configuration for each CorreLog Server. Example: A 100,0000-node implementation managed by 100 different CorreLog servers will typically require about 24 hours to initially configure. Administrative Workload Approximately 1 to 2 hours per week administrative activities, per CorreLog Server type. Operational Workload Approximately 2 to 4 hours per day per CorreLog Server to resolve open tickets, depending upon amount of data collected. Example: An implementation with 10 distinct CorreLog server segments, managing 50,000 devices total will typically require 20 hours per day administrative workload (approximately three full time operators.) Special Considerations Installation and initial configuration of CorreLog servers and remote agents relies mainly upon automated deployment software supplied by the customer. Initial configuration is accomplished by CorreLog remote configuration utilities executed in batch mode. Deployment Guide, Page 8

9 Administrative Ongoing Maintenance CorreLog Server is highly interoperable. The configuration can be easily adapted and modified as requirements change. As part of the ongoing operation of the system, CorreLog administrators can expect several continuing activities. Note that CorreLog supports "role-based" access. Although various CorreLog roles are possible, the CorreLog system typically divides into "administrative" and "operations / user" type roles. The activities described here can be implemented by either "admin" or "user" type roles, but will typically be limited to specific high-level users with "admin" access to the CorreLog server. Changes To CorreLog System Access As part of the ongoing maintenance, CorreLog administrators will grant new logins to the system to users and analysts, and will monitor the internal system security of the CorreLog software, such as by auditing and deleting obsolete users. Addition of New Managed Systems To CorreLog As part of the ongoing maintenance, CorreLog administrators will configure new devices to send messages to CorreLog, and will provision the system to support these devices (such as by adding disk space or changing encryption keys, if needed.) Addition of New Monitor Requirements As part of the ongoing maintenance, CorreLog administrators will configure new event threads, alerts, source filters, destination filters, and other items needed to support expansion or changes to the enterprise, needed to ensure proper security coverage. Addition of New Reporting and Notification Requirements As part of the ongoing maintenance, CorreLog administrators will configure new reports, new notifications, and new interfaces to third-party software (such as to existing Incident Management systems, reporting systems, data sources, and automated ticket actions. Ongoing Operational Workflow CorreLog employs a simple workflow for operators. Each operator is assigned a particular set of tickets (associated with their user ID and CorreLog login, or associated with a particular operational group.) The operator receives ticket notifications via or some other method, or monitors their set of tickets for problems. As tickets are opened on the system, the operator is tasked with resolving these tickets, closing the tickets (possibly with a required and proper resolution.) The ticketing activity Deployment Guide, Page 9

10 can be monitored by system / project management as a method of assessing the workload and effectiveness of the operational staff. Given the above scheme, the precise workflow of operators is therefore governed almost entirely by the number of tickets assigned to each operator, and the difficulty in resolving these tickets. The ticket information is maintained by CorreLog, and is easily assessed by an administrator or supervisory operator. Note that resolution of the ticket may be as simple as adjusting a threshold or adding a system filter, or may be a highly complex activity requiring high-level security analysts. Deployment Guide, Page 10

11 Professional Services CorreLog, Inc. provides professional services to assist in all phases of deployment activities, and assists with all deployment and operational issues through its support division. Prior to deploying CorreLog Server (whether a small single-tier deployment or a large multi-tier deployment) licensed users are encouraged to contact CorreLog for a detailed discussion of options and capabilities. Further information on installation is available from the "Home" page of each CorreLog installation, and is contained in the comprehensive documentation accompanying the product. Refer to the "Installation and Quick Start Guide" for additional information For Additional Help And Information Detailed specifications regarding the CorreLog Server, add-on components, and resources are available from our corporate website. Test software may be downloaded for immediate evaluation. Additionally, CorreLog is pleased to support proof-ofconcepts, and provide technology proposals and demonstrations on request. CorreLog, Inc., a privately held corporation, has produced software and framework components used successfully by hundreds of government and private operations worldwide. We deliver security information and event management (SIEM) software, combined with deep correlation functions, and advanced security solutions. CorreLog markets its solutions directly and through partners. We are committed to advancing and redefining the state-of-art of system management, using open and standards-based protocols and methods. Visit our website today for more information. CorreLog, Inc. mailto:support@correlog.com Deployment Guide, Page 11