Organizations battle to seek out methods to maintain an excellent safety posture. It’s because it’s tough to create safe system insurance policies and discover the suitable instruments that assist obtain an excellent posture. In lots of instances, organizations work with instruments that don’t combine with one another and are costly to buy and preserve.
Safety posture administration is a time period used to explain the method of figuring out and mitigating safety misconfigurations and compliance dangers in a company. To keep up an excellent safety posture, organizations ought to at the least do the next:
- Preserve stock: Asset stock is taken into account first as a result of it supplies a complete checklist of all IT property that ought to be protected. This contains the {hardware} units, functions, and providers which might be getting used.
- Carry out vulnerability evaluation: The following step is to carry out a vulnerability evaluation to determine weaknesses in functions and providers. Information of the vulnerabilities assist to prioritize dangers.
- Guarantee safe system configuration: This entails modifying system settings in an effort to improve general system safety by mitigating dangers. Actions similar to altering default settings, figuring out and eliminating misconfigurations have a tendency to enhance organizational safety posture.
- Monitor all property to detect assaults: Moreover, all IT property ought to be repeatedly monitored to detect assaults towards the infrastructure. This may be carried out by monitoring community, system, and software logs for anomalies or indicators of compromise.
The Wazuh answer
Wazuh is an open supply unified XDR and SIEM platform. It’s free to make use of and has over 10 million annual downloads. The Wazuh platform has brokers that are deployed on the endpoints you wish to monitor. The Wazuh agent collects safety occasion information from the monitored endpoints and forwards them to the Wazuh server for log evaluation, correlation, and alerting.
The Wazuh platform has a number of inbuilt modules with the goal of enhancing the general safety posture of a company. Now we have highlighted some related Wazuh modules within the following sections.
System stock
The Wazuh system stock module gathers data from monitored endpoints the place the Wazuh agent is put in. This module collects the next courses of knowledge from the endpoints:
- {Hardware} and working system data.
- Put in functions and packages.
- Community interfaces and open ports.
- Out there updates and working processes.
Examples of the stock information collected by Wazuh are proven within the picture under:
Info obtained right here is later used for vulnerability or risk detection. For instance, the model of an put in bundle can be utilized to find out whether or not it’s susceptible or not.
Vulnerability detector
The Wazuh vulnerability detector module is used to find vulnerabilities that could be current within the working system and functions on the monitored endpoints. The Wazuh server builds a worldwide vulnerability database from publicly accessible CVE repositories. This data is cross-correlated with the endpoint stock information to detect vulnerabilities. An instance results of a Wazuh vulnerability scan is proven under:
Detected vulnerabilities are categorized into 4 severity ranges particularly: crucial, excessive, medium, and low. This helps when prioritizing dangers and exposures.
Safety configuration evaluation (SCA)
The Wazuh SCA module can assess system configuration and lift alerts when configurations fail to fulfill outlined safe system insurance policies. Wazuh has out-of-the-box SCA insurance policies which might be used to verify for compliance with the Heart of Web Safety (CIS) benchmarks. Customers can simply write their very own insurance policies or prolong present ones to suit their wants. Wazuh SCA insurance policies are written in YAML format which is readable and simple to grasp.
Examples of the occasions generated when the SCA module is executed on an endpoint are proven under:
Every SCA verify on the Wazuh dashboard accommodates details about the configuration that was checked and the remediation steps to harden the system. We increase one of many SCA checks and get the next detailed end result:
With the SCA module, we’re capable of verify for misconfigurations and compliance with varied regulatory frameworks (PCI DSS, GDPR, and NIST). The compliance checks carried out by the Wazuh SCA module are essential for organizations in closely regulated industries.
Risk detection and response
The Wazuh agent forwards safety occasion information to the Wazuh server for malware and anomaly detection. Along with this, the agent runs periodic scans on monitored endpoints to detect rootkits.
Wazuh monitoring capabilities aren’t restricted to the Wazuh brokers alone. The Wazuh platform supplies agentless monitoring for units similar to routers, firewalls, and switches that don’t help the set up of brokers.
As a unified XDR and SIEM platform, safety occasion information from varied safety merchandise are forwarded to Wazuh for correlation and alert technology. A pattern of the Wazuh safety occasions dashboard is proven under:
It’s essential to take remediation actions when safety incidents are detected. Wazuh has the power to automate remediation actions with its lively response module. That is helpful in responding to crucial or frequent alerts that want automation to scale back the workload of the analysts. For instance, an lively response script can block an IP handle making an attempt bruteforce on SSH login. Customized lively response scripts will be created to execute when sure alerts are triggered.
The takeaway
A superb safety posture reduces the assault floor of any group. Now we have highlighted a number of the issues to contemplate in an effort to obtain a preserve an excellent posture. We suggest a free answer that integrates effectively with all kinds of programs, applied sciences, and endpoints. Wazuh is ready to preserve stock, carry out vulnerability evaluation, verify for safe system configuration, and detect and reply to assaults.
Wazuh is free to make use of and has a big neighborhood of customers who help one another and assist to enhance the product. You’ll be able to make the most of the Quickstart information to shortly deploy a Wazuh server, or use the on-demand Wazuh cloud service.
