Visualisation of PF firewall logs using open source

Coetzee, Dirk

Title: Visualisation of PF firewall logs using open source
Creator: Coetzee, Dirk
Subject: Open source software -- South Africa
Subject: Firewalls (Computer security) -- South Africa
Subject: Data logging -- South Africa
Subject: Data integrity -- South Africa
Subject: Data protection -- South Africa
Subject: Computer crimes -- South Africa
Subject: Hacktivism
Date Issued: 2015
Date: 2015
Type: Thesis
Type: Masters
Type: MSc
Identifier: vital:4719
Identifier: http://hdl.handle.net/10962/d1018552
Description: If you cannot measure, you cannot manage. This is an age old saying, but still very true, especially within the current South African cybercrime scene and the ever-growing Internet footprint. Due to the significant increase in cybercrime across the globe, information security specialists are starting to see the intrinsic value of logs that can ‘tell a story’. Logs do not only tell a story, but also provide a tool to measure a normally dark force within an organisation. The collection of current logs from installed systems, operating systems and devices is imperative in the event of a hacking attempt, data leak or even data theft, whether the attempt is successful or unsuccessful. No logs mean no evidence, and in many cases not even the opportunity to find the mistake or fault in the organisation’s defence systems. Historically, it remains difficult to choose what logs are required by your organization. A number of questions should be considered: should a centralised or decentralised approach for collecting these logs be followed or a combination of both? How many events will be collected, how much additional bandwidth will be required and will the log collection be near real time? How long must the logs be saved and what if any hashing and encryption (integrity of data) should be used? Lastly, what system must be used to correlate, analyse, and make alerts and reports available? This thesis will address these myriad questions, examining the current lack of log analysis, practical implementations in modern organisation, and also how a need for the latter can be fulfilled by means of a basic approach. South African organizations must use technology that is at hand in order to know what electronic data are sent in and out of their organizations network. Concentrating only on FreeBSD PF firewall logs, it is demonstrated within this thesis the excellent results are possible when logs are collected to obtain a visual display of what data is traversing the corporate network and which parts of this data are posing a threat to the corporate network. This threat is easily determined via a visual interpretation of statistical outliers. This thesis aims to show that in the field of corporate data protection, if you can measure, you can manage.
Format: 102 p.
Format: pdf
Publisher: Rhodes University
Publisher: Faculty of Science, Computer Science
Language: English
Rights: Coetzee, Dirk

Hits: 1819
Visitors: 1953
Downloads: 171

Collections

RU Department of Computer Science

		Thumbnail	File	Description	Size	Format
View Details Download			SOURCEPDF	PDF	4 MB	Adobe Acrobat PDF	View Details Download