Security fair it-sa: Successful participation of GLACIER-partner DECOIT® GmbH

The security fair it-sa in Nuremberg set new records for yet another year. 753 exhibitors from 25 countries were in attendance to display their products and solutions to an audience of 15,000 experts, thus making the exhibition grounds Germany’s main address for IT-security for the three day duration of the fair. Here, GLACIER-partner DECOIT® GmbH presented their SIEM-based approaches, adding to the program of about 350 forum contributions and 30 congress events.

The focus of the DECOIT® GmbH booth was CLEARER (www.clearer-project.de), an in-house development which extends Network Access Control (NAC) systems by SIEM functionalities. NAC mainly pays attention to correct access to the network and checks rules (policies) that are tailored to the user of the end devices. However, patch levels, unauthorized network traffic or open ports are not controlled or reported. This is where CLEARER comes in, which retrieves the infrastructure data from the NAC system to use it as basic data. If rule violations are detected, the CLEARER system can also be used to exclude a terminal device from the network. This is communicated to the NAC system via a REST API, which both solutions use to communicate bidirectionally with each other.

CLEARER has already been successfully tested with macmon secure (www.macmon.eu), but it can also be used with other NAC systems, such as the open source solution PacketFence (www.packetfence.org), as it also has a REST API. While macmon secure would like to offer this interface more and more to third party vendors, DECOIT® GmbH will implement further application scenarios and anomaly detection in its research project GLACIER in order to further increase its functional scope. To this end, the implementation of integrity checks and log analysis of Windows servers is planned in the near future.

The trade fair it-sa is gradually becoming a permanent meeting place for the security community. This trend has been amplified by the absence of CeBIT. As a result, a wide variety of security solutions could be compared and discussed, yielding valuable insights for the GLACIER project partner DECOIT® GmbH.