School of Engineering and Applied Science

Security Orchestration and Correlation

Framework

Enrollment No. Name

AU1641063 Yash Mehta
AU1641039 Umang Patel

Internal Guide: Dr. Sanjay Chaudhary

B Tech Project Presentation (2019-20)

School of Engineering and Applied Science, Ahmedabad University
School of Engineering and Applied Science

Outline
● Motivation
● Functionalities
● Literature Survey
● Architecture
● Requirements
● Design Steps
● ER Diagram
● Results
● Challenges
● Future Scope
● Timeline

BTech Project 2019-2020 <Project Title> 2

School of Engineering and Applied Science

Motivation
● Cybersecurity breaches lead to serious organizational and
socio-economic consequences, such as loss of revenue, damage to
reputation and information system, and theft of proprietary data
and customer sensitive information.
● Organizations have multiple security tools to detect, investigates
and remediate. But these can’t be integrated together and leads
to huge amount of inefficiency and time-consuming.
● They also don't have any documented process to follow and rely
only on their knowledge. Security Orchestration remedies these
challenges by bringing together various tools by streamlining the
processes.

BTech Project 2019-2020 <Project Title> 3

School of Engineering and Applied Science

Definition: Security Orchestration

● Security orchestration is the connection and integration of an
ecosystem of cybersecurity technologies and processes. It is a
concept that is seemingly more elusive yet more necessary for
today’s SOCs than ever.
● Security orchestration remedies these challenges by bringing
together various tools so they work with one another and by
streamlining the processes that surround the technologies.
● The following are the implementation modules:
○ Security Orchestration
○ Vulnerability Correlation
○ Automated Security Compliance & Response (Risk
Management)
BTech Project 2019-2020 <Project Title> 4
School of Engineering and Applied Science

Functionalities

BTech Project 2019-2020 <Project Title> 5

School of Engineering and Applied Science

Literature Survey
● Organizations lack of a single security tool that can process
the whole of the security operations. Isolated security tools
are considered as a poor communicator and cannot always
assume the presence of another tool.
● According to literature there are multiple paid enterprise
solutions already available in the market which helps users
orchestrate and integrate their different security tools but
there are very few open-source solutions in this area which
can satisfy the needs of CxOs and organizations.
● HP reported 48% of their recorded cyber-attacks were from
known vulnerabilities that are 4-5 years old.
https://www.mcafee.com/enterprise/en-us/assets/infographics/infographicautomation-orchestration.pdf
https://www.forescout.com/wp-content/uploads/2017/04/ Protecting-theConnection-Lifecycle-ForeScout-White-Paper.pdf.

BTech Project 2019-2020 <Project Title> 6

School of Engineering and Applied Science

Architecture

BTech Project 2019-2020 <Project Title> 7

School of Engineering and Applied Science

Software Requirements Hardware Requirements

● Platform: Linux ● None: If SaaS based.
● Container Manager: Docker ● On-premise or Private Cloud:
● Development Framework: Min. 8GB RAM, 500GB HDD
Django (>3.0) – Python
(>3.7.0)
● Database: PostgreSQL
● JavaScript Framework:
NodeJS

BTech Project 2019-2020 <Project Title> 8

School of Engineering and Applied Science

Design Step: Integration of Tools

● We have used different open-source security tools and
projects, and made functional apis using docker container.
● To deploy and test our functions locally, we have ran an
instance of the OpenFaaS gateway, along with a back-end
provider. The simplest way to do this via k3d, a lightweight
Kubernetes distribution that runs in a single container on
your local machine.
● connected the functions with front-end module using node.js
framework.

BTech Project 2019-2020 <Project Title> 9

School of Engineering and Applied Science

Design Step: Vulnerability Prioritization

● The CVE(Common Vulnerabilities and Exposures) data from
NVD(National Vulnerability Database) considered as base
containing 100K data points.
● For simplicity, all punctuation marks and grammatical english
words(stopwords) were removed and text was transformed
to lower case.
● The clean data trained on standard random forest
algorithm(multiple times until good hyperparameter were
found)
● The model was extended so that it can extract and test the
result from multiple security tools and perform prioritization.
BTech Project 2019-2020 <Project Title> 10
School of Engineering and Applied Science

Design Step: Automated Security

Compliance
● There are plenty of regulations out there that mandate patch
frequencies and security controls.
● We derived a common vulnerability & controls matrix based
on various open source classifications.
● Common controls matrix contains references to various
compliance & regulatory standards.

BTech Project 2019-2020 <Project Title> 11

School of Engineering and Applied Science

Design Step: Automated Security

Compliance
● We compare vulnerability findings generated by scanner
engine and also imported through third party data sources
against common controls matrix to determine whether
organizations is compliant to specific standard or not.
● FedRAMP, HIPAA, SOC Type 1, SOC Type 2, etc.
● Compliance score is generated for each compliance standard
based on regulatory requirements of organization.
● Atlast, A “Security Scorecard” will be generated based on all
the modules & vulnerabilities.

BTech Project 2019-2020 <Project Title> 12

School of Engineering and Applied Science

ER Diagram

BTech Project 2019-2020 <Project Title> 13

School of Engineering and Applied Science

Results

BTech Project 2019-2020 <Project Title> 14

School of Engineering and Applied Science

Challenges
● Starting, scaling, and load-balancing of the containers in real
time
● Design architecture in such a way that new scanner can be
easily integrated
● Orchestrating multiple containers ensuring efficiency
● Parsing data feeds received from multiple containers
● Ensuring security of the containers we are using
● De-duplicating vulnerabilities and prioritize with high
accuracy

BTech Project 2019-2020 <Project Title> 15

School of Engineering and Applied Science

Future Scope

● Define our own model using our own collected data runs in
real-time.

BTech Project 2019-2020 <Project Title> 16

School of Engineering and Applied Science

Timeline

BTech Project 2019-2020 <Project Title> 17

School of Engineering and Applied Science

Happy security to you!