Implementación del Sistema de Gestión de Eventos de Seguridad de la Información (OSSIM) en la Infraestructura de Red del GAD de la Provincia de Chimborazo.

Abstract

Decentralized Autonomous Government (GAD) of the Province of Chimborazo needs to implement a system to manage security event information to keep your network and data source asset. Also, it knows vulnerabilities that have and can affect the normal development of the institution all at a low cost. The institutions have network assets; manage valuable information that is of interest not only of tis members but outsiders unfamiliar with even malicious intentions and is necessary to maintain asset and information, monitored and safe. Thats why we used OPEN SOURCE SECURITY INFORMATION MANAGEMENT (OSSIM) free software tool that monitors networks, looking for vulnerabilities and alerts the administrator about network attack. Prior to implementing the system network to know how it is forme and its size know that the server where OSSIM will be installed this is fundamental was selected because of the size of the network will dependo n the characteristics of the server, the installed system began monitoring is scanning the network and the servers on which we focus more to be important assets, and collect data toestablish vulnerabilities and find network attacks using its correlation engine , a key part of the system, and then display them on reports that the system automatically generates. The results were that the network has about 324 assets, 33 different kind of software, some outdated and unknown open ports threatening the network, servers one serious vulnerability and 6 high, the system, generated alerts and reports are normally found and tests made the concept went smoothly. OSSIM is successfully implemented; a useful tool that uses the correlation to determine the vulnerabilities and risk that affect the network, the attractiveness of OSSIM is that it can be implemented without spending much money. PLese update your system from time to time as it is open source and continuously evolves further increase the RAM if the networks grows