OPEN SOURCE SECURITY INFORMATION MANAGER

OSSIM What is OSSIM

 OSSIM is an open source security system.  OSSIM integrates more than 30 open source tools.  OSSIM gathers events from any device or application.  OSSIM includes a powerful correlation system.  OSSIM can be integrated with any already deployed device or application in the network.  OSSIM generates a wide number of metrics and reports.  OSSIM is easily adaptable (Use what you need)  OSSIM can be integrated with proprietary and open source products. What is not OSSIM

 OSSIM is neither a firewall nor a content proxy  OSSIM is not a Security Distribution (Backtrack, WifiSlax)  OSSIM is not a product for home use  OSSIM is not a simple software package (exe, rpm, deb...) which can be easily installed on any Operative System. Advantages

 Freeware-no doubt about backdoors.  customizable according to requirement.  2300+ data source plugins.  Highly Scalable.  High Redundancy/Availability.  Provide security at every level. (IDS/IPS ,firewall, antivirus servers, proxy, Domain controller, VPN servers, web servers, OS ).  Correlation (Cross correlation & Logical Correlation).  Correlation Directives (200+)  Risk calculation  Reporting System Requirements

 RAM:4GB RAM  Processor:64 bit processor  LAN Card: e1000 network card OSSIM in Real World Architecture

Typically OSSIM consists of four elements;  Sensors(Detector + Collector)  Detector Generates events.  Collector Collects and analyzes data using predefined RegEx.  Management Server  The main Server tasks as Normalizing, Prioritizing, Collecting, Risk Assessment and Correlating engines  The maintenance and external tasks, as backups, scheduled backups, online inventory or scanning launching  Database  Front end Web Interface How OSSIM Works

 Devices and/or applications generate security events(Detectors).  Events are gathered by OSSIM collector.  The collectors send normalized events to the OSSIM Server.  The OSSIM Server does a risk calculation for every event.  The events are correlated in the OSSIM Server.  Events are stored in database.  The Web Console offers access to all the information collected and generated by OSSIM. How OSSIM Works OSSIM Operation OSSIM Operations OSSIM Web Interface Integrated Tools OCS Nfdump and NFSen NetFlow OpenVAS OSVDB OSSEC NMAP POf Pads ARPWatch TCPtrack Nepenthes Sample Deployment The End

Thanks…