Search

Network security has been a major issue long time ago. Confidentiality, integrity and availability of data are the primary concerns of any network administrator. Recently, several attacks have resulted in huge losses of resources and of data availability. For example, in May 2017, medical entities in the United Kingdom have been paralyzed due to WannaCry ransomware world-wide cyber-attack. Thus, the main objective of this paper is to propose a more secured network architecture that will be designed for the case of the PACS - Picture Archiving and Communication System - that is used for storing and transmitting radiography images and reports through the hospital internal network. This paper presents an off-the-shelf solution based on the concept of one-way link data diode and open source softwares to assure safety and security in a cost effective manner. The novelty of this approach is in the design of a data diode that limits the physical connection to two network interfaces, and eliminates the need for a third network connection needed to provide a carrier signal for the transmitter. This system has shown some latency in data transfer but has increased the safety and the security of files transferred between the PACS network and the external network. © 2019 IEEE.

U ovome radu analizirana su svojstva sustava za upravljanje sigurnosnim informacijama i događajima u lokalnoj mreži (sustava SIEM). Navedene su ključne funkcionalnosti toga sustava te su analizirane njegove dvije implementacije: sustav Graylog i sustav Wazuh. U praktičnome djelu rada postavljena je lokalna mreža zamišljene trgovine „Mala trgovina“. Unutar te mreže koja se sastoji od 12 osobnih i dva poslužiteljska računala postavljeni su i sustavi Graylog i Wazuh. Četirima jednostavnim scenarijima testirane su reakcije sustava Graylog i Wazuh na određene događaje koji upućuju na zlonamjerno korištenje sustava. In this thesis the properties of Security Information and Event Management System in a local network are presented and described. The key functionalities of the SIEM system are listed and discussed, and two SIEM system implementations, the Graylog system and the Wazuh system, are analysed. In the practical part of the thesis, a local network for imaginary store "Mala Trgovina" was set up. Within this network, which consists of 12 personal and two server computers, both Graylog and Wazuh systems have been set up. Through four simple scenarios, the reactions of the Graylog and Wazuh systems to specific events that point to the malicious use of the system have been tested.