Crypto sim_cryptolog_cryptospot_v3
0 likes798 views
CryptTech Inc. provides security products including CryptoSIM, an integrated security information and event management (SIEM) system that uses artificial intelligence to analyze logs and detect threats. CryptoSIM normalizes, categorizes, and correlates log data from multiple systems to identify simple, logical, contextual, cross, retrospective, and hierarchical correlations that may indicate security incidents. It also evaluates security risks and provides incident management. CryptoLOG is a log collection and analysis tool that collects logs through various methods and over 300 plugins. It provides statistical reports and dashboards to monitor network activity and detect anomalies.
Crypto sim_cryptolog_cryptospot_v3
- 1. CryptTech Inc. CryptTECH CryptoSIM, CryptoLOG, CryptoSPOT Information Security Intelligence
- 2. CryptoSIM Executive’s Brief IT threats against organizations are increasing day by day. These threats may be in forms of worms, viruses, Trojans, phishing and similar attacks deployed by internal or external attackers, causing fatal events for companies like company’s secrets theft. Firewalls or attack prevention systems are capable of preventing the placement of all intricate worms or rootkits in an in-house computer. Employee’s PC can easily get infected with malwares from an infected web sites or social network applications accessed by them. Nowadays, Trojans, worms and viruses are specifically programmed for firms and access information can be gathered due to phishing and social engineering attacks. Such threats have made systems vulnerable to attacks which is not preventable with normal IDS systems. Harmful codes specifically developed for companies cannot be detected by anti-virus systems operating on signature-basis. Attacks structures are getting updated and more and more complex. Furthermore attacks to business applications are harder to identify by firewalls and detection systems constituting the border protection software. Recent Security violations especially in regard to cellular phones proved that each mobile device, server, client, notebook or any other smart device are prone to security vulnerabilities. As threats are becoming more sophisticated and mobile devices are exposed to attacks, signature-based detection systems cannot detect attacks. As information security increasingly turns into a chaotic structure, all systems, servers, mobile devices and business application logs should be gathered and analyzed, correlated, differentiated, and their anomalies should be examined. These billions records cannot be examined and inspected by human resources. Therefore, automated systems are required to do the analysis and find the correlations using correlation directives which are the artificial intelligence. Systems named as SIEM can make such analysis and correlations. CryptoSIM is an integrated Security Information and Event Management system representing unique correlation and analysis via its correlation directives. CryptoSIM proactively captures the log data, and provides the possibility to analyze and diagnose threats and anomalies and notifies existence of potential threats. IT teams can use CryptoSIM to meet the security management necessities beside legal compliance mandates apart from security analysis and warnings. They can test the existing compatibility levels using compatibility template reports available in CryptoSIM. CryptoSIM provides a thorough analysis of event data and plenty of reporting templates over audit records, it ensures first-hand analysis for both existing security units and supervisors. Normalization Normalization is in fact assigning a universal data structure format on collected data for equivalent fields and then differentiate it over the log. This process makes comparison and correlation calculation between events possible within a unified schema and can be deployed in a plug-in structure. Categorization Categorization is a method used to classify the logs. Events are translated into a taxonomy based on their category and sub-category. Unification Unification is simplification of recurring events into a single event. Event Correlation Correlation is the process of representing the relations between records of incidents from multiple resources where correlation rules defines the relation patterns among disparate events. In other words, it gives an all- encompassing view of various evens relation for security behavioral inspection. CryptoSIM correlation engine supports different real time correlation types which are; Simple Correlation is examination through correlation of the logs from one resource. Five erroneous connection trials to a server within one minute is classified under this category. Logical Correlation is being implemented by the Correlation Directives using logical tree structures. This type of structure is also known as AND/OR tree, and is generally used in artificial intelligence systems. When a condition node overlaps, the correlation engine will head to sub-nodes. As the correlation engine advances in overlapping conditions, the reliability of the correlation varies in accordance. As more evidences are obtained that there has been an attack going on, the probability of the alarm increases as well. As an example; if an attack perceived by the Detection system has passed from the firewall, and if a request is received from the concerned server without two- directional traffic; then the system reports this as ‘the attacked server is influenced’. Here the logs of more than one system was received and examined, and all conditions of the nodes were met, so reliability probability is high. Contextual Correlation; this kind of correlations underline asset value and type. If the asset value is high, then the risk value will be high, and necessary alarms will be produced. If the asset value is low (for example in test systems) then the risk value will be low, and there will be a different reply form. The asset type will be considered as well. For instant, when the attack detection system perceives an attack that concerns Windows servers but the attacked system is Linux, the priority value decreases. Cross correlation; cross correlation evaluates malicious data additionally. The logs from security vulnerabilities and the logs from attack detection systems are correlated, and the priority value is determined accordingly. Retrospective correlation; While CryptoSIM is able to correlate in the server memory in real time, it also can apply correlation rules on the old logs to investigate the occurrence of the pattern formations in the past. Hierarchical correlation; CryptoSIM can send the correlated records to a superior correlation engine for further inspection. The records kept in the first correlation can be re-correlated in the next correlation engine according to distinct rules. As a result N-level relation extraction becomes possible. Risks Evaluation Security Risk values calculation are supported by CryptoSIM in view of their Asset value, Priority Value and Reliability value.
- 3. Incident Management CryptoSIM also provides an incident management system which makes it possible to apply controlling actions against security incidents. CryptoLOG Dashboard CryptoLOG Dashboard screen can detect and represent all logs collected and processed by the system according to their categories. The processor, memory and disk performance can be monitored based on real time EPS - Event per Second. Distribution of log sources are shown on monthly, weekly and daily basis for total record numbers in charts and graphs on dashboard screen. Thus, it depicts the total activity performance of the network on same interface which simplifies monitoring to detect an unusual process. CryptoLOG dashboard is equipped with scrolls and enables abrupt access for supervisors to drill down on more detailed information on the statistics of graphs and events. Automatic transition of the system can be ensured by defining the desired number of Special Indicators between statistical chart or alarm screens. This screen is reflected using projection or LCD panel to allow illustration of hundreds of charts in requested intervals. Log Collection and Advanced Plug-in Structure CryptoLOG log collection process can be performed through several methods. The most used methods can be listed as OPSEC, Syslog, agent, socket, SNMP, ODBC, OLE DB, native DB, WMI, remote registry, share, samba, ftp, sftp or ssh. CryptoLOG offers a unique log processing capacity with its advanced plug-in structure. Plug-in substructure uses regex or CryptoLOG pattern processing functions. Both methods allow extra plug-in’s to be written electing wizards or direct plug-in steps. Plug- in codes can be written and added in addition to these methods. Cryptolog involves C# and VB code operating engines by default. Desired codes can be added within the plug-in. CryptoLOG has over 300 prepared plug-ins by default. It is up to the user which plug-in to use on the flexible powerful plug-in interface. Alarm fields and messages can be defined on the plug-ins. When a log is processed, it produces the alarm specified by the system user independent from its confirming template or field. Up-to-date plug-ins can be automatically drawn with a client over web repository. Statistical Reports In addition to statistical data, several kinds of reports on collected logs statistics are available on the system. These reports can be formed through query optionally in real time or scheduled on specified times by user. These reports are not static and are customizable based on their application. Reports can be obtained over desired fields of the logs, and can be conveyed to PDF, EXCEL, WORD and CSV environment. Furthermore, statistical information about fields can be obtained over plug-ins. As logs are collected, CryptoLOG keeps counters according to their fields, and reports about these counters can be obtained on user’s request immediately where normally demonstration of reports takes hours of time if the system would not have real time calculations. The rapid access to reports is one of the unique advantages of CryptoLOG which takes just a few seconds in major systems with billions of records. Immediate Statistical Reports Immediate Statistic module can be obtained over a desired time interval and ensures that analysis can be made over the desired field independent from the statistical counters defined on the plug-in. Traditional Reports The reports menu on CryptoLOG provides the possibility to use over 300 prepared report templates. Reports can be produced according to the desired parameters by selecting the proper report templates. Scheduled reports can be taken from the system based on time dependent applications. These reports can be sent to a specific person via e-mail on request. Report templates can be easily prepared using report preparation wizards, and if desired, regular expressions are described in each log field (RegEx) on the advanced reporting section. Compatibility reports can be taken over GLBA, SOX, HIPAA, FISMA, PCI templates. All kinds of templates can be issued, and the firms can form their compatibility templates in accordance with their own policies.
- 4. Forensic Analysis CryptoLOG provides an advanced query for Forensic inspections. More than one Query can be performed at a time. Queries can be made over processed and differentiated log lines. Original logs are shown in queries on request basis, and the results of such queries can be conveyed to PDF, EXCEL, WORD and CSV format. High Availability CryptoLOG operates on active-passive basis with its grouping substructure, and provides high availability. It can also operate on an active-active basis, which allows load sharing on systems. Non-Repudiation and 5651: CryptoLOG takes the hashes of the logs it processes in accordance with its inherent non-repudiation substructure and stamps them with time stamps and signs with digital signature. This transaction is made every second. Due to request; when log files are closed or at the end of the day, they are stamped using timestamp service of UEKAE. CryptoLOG allows selection of hash and signature algorithms used with parametric substructure. RSA (1024 bit) or DSA are used by default in signature algorithms. Hashing algorithms can be selected optionally between MD5, SHA1, SHA216, and SHA512. Each log line can be signed on request basis. Cryptolog ensures the possibility of external data transfer for legal regulations. By selecting External data transfer for Legal Query in Forensic Analysis section, the original log files, digital signature files with hash and timestamp information and certificates can be transferred to external storages. Archive and Back-up CryptoLOG can back-up the system configuration and plug-in at the requested storage pool, and also can transfer the logs processed to different environments reliably. Query can be made over archived logs on request basis. Consequently, no additional transaction is necessary when there is the need of query over archive records. CryptoLOG logs can be compressed by a rate of 1:30. Analyses and reports can be made directly over compressed data without any additional transaction. User Management and Authorization CryptoLOG offers an advanced authorized substructure in sense of menu and function. User management is made on role basis, and the formed roles can be assigned desired features and authorities by the system administrators. Authorizations existing in this section go as low as the plug-in level. Agent Management: Cryptolog agents can be administered from a centralized system. It can be installed on remote servers and clients, and the configurations of the agents can be made over the dashboard from the center. Groups can be formed in this section, and policy/configuration can be sent to agents under a certain group collectively. Besides, operating and non-operating agents can also be checked over screens showing the operational status of the agents. CryptoSPOT CryptoSPOT is a hotspot product. It is developed for practical use of the cable or wireless internet service provided with or without a fee in multi- user environments. In addition to users defined over it; it can ensure user authorization connecting to 3rd party databases such as SMS services, Active Directory and hotel’s software. Thus, it offers flexible use in different environments. It is possible to record the internet accesses over hotspot system and send them to a third log storage systems. User Definitions; For each user, name, user name, password, timeout, period of use, download/upload bandwidth limit, simultaneous use permit values can be entered. Mac address definition screen exists for devices that should be allowed to the internet without passing over captive portal. Users who are asked to obtain a password via SMS can be recorded by default, and can be directly recorded over the login screen. Active Directory/LDAP resources can be defined. All users in these resources can be permitted, and internet allowance to only determined groups and/or different speeds can also be defined. There are policy screens related to these transactions. Configurations; Entire network (IP, gateway, DNS and route) configuration can be made over the interface. More than one hotspot network can be defined. DHCP IP distribution interval etc. configuration for each network can be made distinctively over the interface. Syslog configuration is available for logs to logging systems. Furthermore welcome screen configurations are available over the interface. Login methods that can be used in these screens (SMS, local, Active directory) are available separately or within the same profile. Not only different profile definition is possible for each hotspot network, but also common login profile is available. Users can be initiated only by arrangement of the concerned access information within pre-defined SMS services. As to undefined SMS services, their addition is quite easy with its modular structure.