The following paper presents the activities carried out by the Marche Region’s Computer Security Incident Response Team (CSIRT). These activities are part of the collaboration between the Polytechnic University of Marche and the Marche Region on these issues and aim to update the CSIRT’s procedures, particularly its intrusion response plans. Reviewing procedures and plans is a crucial activity for every CSIRT and must be based on an updated assessment of cyber incident trends. This thesis was therefore divided into three phases. In the first phase, the existing situation was analyzed, specifically the Marche Region’s IT infrastructure and the tools used. This led to a deeper understanding of the tools currently used to implement Security Information and Event Management (SIEM) capabilities, parti- cularly the use of Elasticsearch for collecting and analyzing logs from all the machines that comprise the Marche Region’s architecture. Particular attention was paid to the dashboard used which are composed of a set of indicators used to monitor the status of the infrastructure and detect the presence of critical situations; in this phase, the advantages and limitations of each dashboard were highlighted, and a set of recommendations was suggested to address the most critical issues. In the second phase, a sample dashboard was designed and implemented, including all indicators necessary for service monitoring. The DNS service was selected based on an analysis of the Business Impact Analysis (BIA) conducted by the Marche Region. This artifact was created to assess the potential impact and business consequences caused by incidents. In the third phase, the response plans for Denial of Service (DoS) attacks were reengineered. These attacks can compromise the critical services provided by the Marche Region. These services must guarantee high reliability and operational continuity. Specifically, the portal providing real-time regional election data was used as a case study. To this end, two cyber ranges, i.e., two isolated test environments, were created: one at the Marche Region and the other at the Department of Information Engineering at the Polytechnic University of Marche. These cyber ranges were used to compare the effectiveness of the reengineered plan with that of the original plan. At the heart of the reengineered response plan is a firewall based on proof-of-work (a testing technique also used in blockchains like Bitcoin) to protect critical services. The idea is to run a client-side test that guarantees the firewall the authenticity of the intercepted request. In the experimental phase, the use of PoW Shield, a Web Application Firewall (WAF), was evaluated. During the experiments conducted at the university cyber range, the adoption of an alternative solution to Elasticsearch was also evaluated: Wazuh, an open source alternative to the main SIEMs on the market.
Il seguente elaborato presenta le attività svolte presso il Computer Security Incident Response Team (CSIRT) della Regione Marche. Tali attività si inseriscono nell’ambito della collaborazione tra Università Politecnica delle Marche e Regione Marche su questi temi e hanno l’obiettivo di aggiornare le procedure del CSIRT, in particolare i piani di risposta alle intrusioni. La revisione di procedure e piani è una attività cruciale di ogni CSIRT e si deve basare sulla valutazione aggiornata dei trend dei cyber incident. Il presente lavoro di tesi si è quindi articolato in tre fasi. Nella prima fase è stata analizzata la situazione esistente, in particolare l’infrastruttura informatica di Regione Marche e gli strumenti utilizzati. Questo ha portato ad approfondire quali strumenti vengono attualmente utilizzati per implementare le funzionalità di Security Information and Event Management (SIEM), in particolare l’utilizzo di Elasticsearch per la raccolta e analisi di log da tutte le macchine che compongono l’architettura di Regione Marche. Particolare attenzione è stata dedicata al cruscotto (dashboard) utilizzato per ogni servizio, ovvero l’insieme di indicatori utilizzati per monitorare lo stato dell’infrastruttura e rilevare la presenza di situazioni critiche. Per ognuno di essi sono stati sottolineati gli indicatori ben formati e proposto una reingegnerizzazione di quelli malformati. Questo ha comportato anche una valutazione degli strumenti attualmente utilizzati Nella seconda fase è stato progettato e implementato un cruscotto di esempio, comprensivo di tutti gli indicatori per il monitoraggio del servizio selezionato. In particolare è stato scelto il DNS, a seguito di un’analisi della Business Impact Analysis (BIA) effettuata da Regione Marche. Questo artefatto nasce dall’esigenza di determinare l’impatto e le ricadute sul business causate da incidenti. Nella terza fase sono stati reingegnerizzati i piani di risposta ad attacchi di tipo Denial of Service (DoS), attacchi che possono compromettere i servizi critici erogati da Regione Marche. Tali servizi devono infatti garantire alta affidabilità e continuità operativa. In particolare, come caso di studio, è stato preso il portale per fornire in tempo reale i dati delle elezioni regionali. A tal fine, sono stati realizzati due cyber range, cioè due ambienti di test isolati: uno presso la Regione Marche e l’altro presso il Dipartimento di Ingegneria dell’Informa- zione dell’Università Politecnica delle Marche. Questi cyber range sono stati utilizzati per confrontare l’efficacia del piano reingegnerizzato con quella del piano originale. Al centro del piano di risposta reingegnerizzato si trova un firewall basato sul proof-of-work (una tecnica di prova utilizzata anche nelle blockchain tipo Bitcoin) da mettere a protezione dei servizi critici. L’idea consiste nello svolgimento di una prova, lato client, che garantisca al firewall l’autenticità della richiesta intercettata. Nella fase sperimentale è stato valutato l’impiego del web application firewall (WAF) PoW Shield. Durante gli esperimenti effettuati presso il cyber range universitario è stata inoltre valutata l’adozione di una soluzione alternativa ad Elasticsearch: Wazuh, una alternativa open source ai principali SIEM presenti sul mercato.
REINGEGNERIZZAZIONE DEI PIANI DI RISPOSTA ALLE INTRUSIONI DELLO CSIRT DELLA REGIONE MARCHE
PARISI, FRANCESCO ROMEO
2024/2025
Abstract
The following paper presents the activities carried out by the Marche Region’s Computer Security Incident Response Team (CSIRT). These activities are part of the collaboration between the Polytechnic University of Marche and the Marche Region on these issues and aim to update the CSIRT’s procedures, particularly its intrusion response plans. Reviewing procedures and plans is a crucial activity for every CSIRT and must be based on an updated assessment of cyber incident trends. This thesis was therefore divided into three phases. In the first phase, the existing situation was analyzed, specifically the Marche Region’s IT infrastructure and the tools used. This led to a deeper understanding of the tools currently used to implement Security Information and Event Management (SIEM) capabilities, parti- cularly the use of Elasticsearch for collecting and analyzing logs from all the machines that comprise the Marche Region’s architecture. Particular attention was paid to the dashboard used which are composed of a set of indicators used to monitor the status of the infrastructure and detect the presence of critical situations; in this phase, the advantages and limitations of each dashboard were highlighted, and a set of recommendations was suggested to address the most critical issues. In the second phase, a sample dashboard was designed and implemented, including all indicators necessary for service monitoring. The DNS service was selected based on an analysis of the Business Impact Analysis (BIA) conducted by the Marche Region. This artifact was created to assess the potential impact and business consequences caused by incidents. In the third phase, the response plans for Denial of Service (DoS) attacks were reengineered. These attacks can compromise the critical services provided by the Marche Region. These services must guarantee high reliability and operational continuity. Specifically, the portal providing real-time regional election data was used as a case study. To this end, two cyber ranges, i.e., two isolated test environments, were created: one at the Marche Region and the other at the Department of Information Engineering at the Polytechnic University of Marche. These cyber ranges were used to compare the effectiveness of the reengineered plan with that of the original plan. At the heart of the reengineered response plan is a firewall based on proof-of-work (a testing technique also used in blockchains like Bitcoin) to protect critical services. The idea is to run a client-side test that guarantees the firewall the authenticity of the intercepted request. In the experimental phase, the use of PoW Shield, a Web Application Firewall (WAF), was evaluated. During the experiments conducted at the university cyber range, the adoption of an alternative solution to Elasticsearch was also evaluated: Wazuh, an open source alternative to the main SIEMs on the market.| File | Dimensione | Formato | |
|---|---|---|---|
|
Tesi_Magistrale_Parisi_Francesco_Romeo_PDFA.pdf
embargo fino al 08/06/2027
Dimensione
10.62 MB
Formato
Adobe PDF
|
10.62 MB | Adobe PDF |
I documenti in UNITESI sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.
https://hdl.handle.net/20.500.12075/24534