A diploma thesis of the htl rennweg

Armament

A violett triangle containing and showcasing the SOC-Triad.

Project idea

Our project consists of a corporate network with three locations that are virtualized in the Cisco UCS (Unified Computing System). Furthermore an AD is set up and each location has a firewall that allows them to access the outside world and each other. Also the network is further secured with the „SOC“ (Security Operations Center) cybersecurity concept. This includes the three components of the SOC-triad: EDR (Endpoint, Detection and Response), NDR, and SIEM. For this purpose, the team is pursuing the FCP (Fortinet Certified Professional) Security Operations certification. Finally, the security of the network will be tested with attacks.

Aspects Of Our Project

NDR

NDR stands for Network Detefction and Response and is a cybersecurity solution that is utilized to continuously monitor network traffic using advanced analytics, machine learning, and threat intelligence to detect suspicious or malicious activity and to automatically respond according to the situation.

SIEM

A SIEM, Security Information and Event Management, system is a centralized platform that collects, aggregates, normalizes, and analyzes security-related data of a IT Infrastructure. It is used to detect threats, trigger alerts, support incident response and display activity within the network.

EDR

EDR, Endpoint, Detection and Response, is a cybersecurity relevant tool deployed on endpoints and other participants of the network to ensure security, by monitoring endpoints for suspicous or malicious activity. It is also possible to provide various automated responses for different scenarios.

Virtualization

The network with its three sites is virtualized in the Cisco UCS (Unified Computing System). The UCS is an integrated architecture that is alike to a data center, as it combines computing, networking, storage access, and virtualization into a single platform.

Firewalls

All three locations of the corporate network are only able to communicate with the outside and each other through the firewalls, as it permits or denies traffic. These NGFWs (Next Generation Firewalls) utilize many features to ensure security or special types of connectivity such as VPNs.

Certification

We are learning for the FCP Security Operations certification, as we will attempt to get certified and learn about networking and some Fortinet-products such as Fortigate and FortiSIEM.