Search

El projecte consisteix a desplegar una solució completa de ciberseguretat basada en el núvol per a empreses, centrant-se en el monitoratge de dispositius informàtics. S'utilitzarà la plataforma Kubernetes per a gestionar la infraestructura i s'implementaran diverses eines de codi obert, com Wazuh, Velero i Terraform, per a proporcionar funcionalitats com XDR, SIEM, còpies de seguretat i automatització de desplegaments. L'objectiu principal és enfortir la seguretat de l'empresa client, permetent la detecció precoç d'amenaces, la gestió eficient d'incidents i la recuperació ràpida davant desastres. A més, es milloraran els processos interns, establint polítiques de còpies de seguretat, cicles de vida de les dades i protocols de recuperació. Aquest projecte es destaca pel seu enfocament en l'adopció de tecnologies basades en el núvol i la seva integració d'eines open source, brindant una solució escalable, flexible i econòmica per a les necessitats de ciberseguretat de les empreses., The project consists of deploying a complete cloud-based cybersecurity solution for companies, focusing on computer device monitoring. Kubernetes will be used to manage infrastructure and several open source tools, such as Wazuh, Velero and Terraform, will be implemented to provide functionality such as XDR, SIEM, backups and automation of deployments. The main objective is to strengthen the safety of the client's company, allowing early detection of threats, efficient incident management and rapid disaster recovery. In addition, internal processes will be improved by establishing backup policies, data life cycles and recovery protocols. This project is noted for its focus on adopting cloud-based technologies and integrating open source tools, providing a scalable, flexible and cost-effective solution to the cybersecurity needs of companies.

Endpoint detection and response is an integral part of the security of large-scale networks. Embedded hardware, such as those found at Ericsson Radio Access Network endpoints, have strict performance requirements that need to be met. This fact makes implementing intrusion detection non-trivial, as intrusion detection software often generate a lot of processing overhead. Wazuh, an established open-source distributed and centralized intrusion detection and response system, shows a lot of promise as a large-scale intrusion detection system. It is very modular and has various capabilities that can be utilized in different ways to minimize processing overhead. One of these capabilities is native support for the native Linux syscall monitoring tool AuditD. While AuditD is very capable, it can introduce severe performance penalties in certain scenarios. Falco is another syscall monitoring tool that shows promise with regards to performance, and also has more features than AuditD; which is why Falco is included as a direct comparison to AuditD. This study evaluates Wazuh, AuditD, and Falco based on a set of requirements set by Ericsson, including flexibility, scalability and reliability, by enacting performance benchmarks with normal background operations active. The results of this study show that, with the correct configuration, Wazuh can be used as an intrusion detection system in embedded systems with limited hardware, where AuditD and Falco can serve as a great addition to detecting indicators of compromise. The solution is to use a minimal intrusion detection ruleset, and in the event of suspicious activity, activate more modules to increase threat detection at the cost of CPU overhead and execution time for normal system operation.

Endpoint detection and response is an integral part of the security of large-scale networks. Embedded hardware, such as those found at Ericsson Radio Access Network endpoints, have strict performance requirements that need to be met. This fact makes implementing intrusion detection non-trivial, as intrusion detection software often generate a lot of processing overhead. Wazuh, an established open-source distributed and centralized intrusion detection and response system, shows a lot of promise as a large-scale intrusion detection system. It is very modular and has various capabilities that can be utilized in different ways to minimize processing overhead. One of these capabilities is native support for the native Linux syscall monitoring tool AuditD. While AuditD is very capable, it can introduce severe performance penalties in certain scenarios. Falco is another syscall monitoring tool that shows promise with regards to performance, and also has more features than AuditD; which is why Falco is included as a direct comparison to AuditD. This study evaluates Wazuh, AuditD, and Falco based on a set of requirements set by Ericsson, including flexibility, scalability and reliability, by enacting performance benchmarks with normal background operations active. The results of this study show that, with the correct configuration, Wazuh can be used as an intrusion detection system in embedded systems with limited hardware, where AuditD and Falco can serve as a great addition to detecting indicators of compromise. The solution is to use a minimal intrusion detection ruleset, and in the event of suspicious activity, activate more modules to increase threat detection at the cost of CPU overhead and execution time for normal system operation.