DEVELOPING MODEL INFORMATION PROTECTION CORPORATE NETWORK BASED ON THE IMPLEMENTATION OF SIEM-SYSTEM
The actual problem of detection and localization of the malicious information which is in corporate networks in big information massifs is formulated. Basic data for formation of the necessary list of ways and means of information protection are defined. The characteristic of SIEM systems as one of modern approaches in the solution of tasks of information security of corporate networks is provided. The main objectives solved on the basis of introduction and operation of SIEM system and also standard functionality at identification of events and incidents of information security are listed. The typical structure at introduction of the main components of SIEM system is given and specification of functional levels of work of system. Conditions for creation of effective system of information security on the basis of implementation of SIEM system are formulated. The structurally functional model of SIEM system is developed. The structure of the main hardware resources of information system sufficient for ensuring effective work of SIEM system is determined and calculated. The description of settings of system, and procedure of writing of rules as sequence of necessary actions is provided. The scheme of algorithm writing of rules is developed. Stages of writing of the rule are listed. The stage of writing the rule on the example of detection of TCP, ICMP, UDP connections from the subgroups which don't have the right of Internet connection is considered. An inspection of operability of regular expression is for this purpose carried out. It is created rules in the QRadar editor and for this rule and necessary rules of operation of SIEM system are chosen. Setting up rules by means of control properties of the incident generated at operation of the rule is carried out. Necessary conclusions are drawn.