RU2537274C1 - Integrated system of audit and monitoring of information security of local computer network of enterprise - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: system comprises a server with the central database, one commutation switch of the local computer network, connected with two personal computers, a commutation switch with wireless connection and a router of the Internet network, and also one module of the complex of audit, the module of the complex of audit with wireless connection, and the module of the complex of audit with connection from the external network of the Internet.

EFFECT: improvement of accuracy of detection of unauthorised access to information of the enterprise through the introduction of additional modules of audit.

1 dwg

Description

FIELD OF THE INVENTION

The invention relates to computer networks for data transmission and processing, in particular, to an integrated system for auditing and monitoring information security of a local area network of an enterprise, and can be used in automated information protection tools for auditing and monitoring the security of enterprise automated systems based on a single-board computer with a modular connection diagram to the local area network of the enterprise.

State of the art

A device for monitoring the security of automated systems containing a frequency divider, a memory receiving unit, a subtracting counter, reference memory blocks, decryption units, counters, I elements, address receiving units, comparison units, decoders, register, display unit (see US Pat. No. 2270478, IPC G06F 17/40, G06F 12/14, publ. 02.20.2006).

The disadvantage of this device is the design complexity, low reliability.

A well-known automated operational management system for the enterprise, containing a server with a server communication module and a central database connected by two-way communication with external data sources, one client terminal with a client communication module, server and client communication modules are connected by two-way communication through a communication channel, the server is additionally equipped with a module for generating an individual control point for the current client and an individual module in data sampling for the current client and is configured so that the module for generating an individual control point for the current client is connected to external data sources with one input, connected to the server communication module with the second input, and connected to the central database input, which is connected to the output of the server communication module, with the output (see Pat. RU No. 2441274, IPC G06F 17/40, H04L 12/00, published on January 27, 2012).

The disadvantage of this system is limited functionality, design complexity.

The closest in technical essence and the achieved positive effect and adopted by the author for the prototype is an enterprise information security monitoring device, with the help of which regular monitoring of events occurring in the process of information exchange is performed, with registration and analysis of predefined significant or suspicious events, containing a server with a central database data, at least one LAN switch connected to at least two personal computers, comm a tator with a wireless connection and an Internet router (see Konev I.R., Belyaev A.V. Information security of an enterprise. - SPb .: BHV - Petersburg, 2003. - 752 pp., ill. on page 30).

The disadvantage of this device is the narrow scope, namely the device implements the search for information blocks in the array using the structural recognition method without taking into account the possible presence of a large number of repeating types of data blocks.

Disclosure of invention

The objective of the invention is to develop a comprehensive audit and monitoring system of information security of the local computer network of the enterprise, with the ability to accurately detect unauthorized access to company information on a one-time or permanent basis using a single-board computer with a modular scheme for connecting to the local computer network of the enterprise, while simplifying the design, small size and power consumption, built-in and inconspicuous location m

The technical result that can be obtained using the present invention is to simplify the design, small size and power consumption, embeddedness and inconspicuous location, as well as the ability to accurately detect unauthorized access to enterprise information.

The technical result is achieved using an integrated audit and monitoring system of information security of a local area network of an enterprise, containing a server with a central database, at least one local area network switch connected to at least two personal computers, a wireless connection switch and an Internet router, while it is additionally equipped with at least one module of an audit complex, an audit complex with a wireless connection and audit trail connected from an external Internet network, and at least one LAN switch connected to at least two personal computers is connected to at least one module of the audit complex and to an Internet router, the latter is connected to at least one server with a central database with at least one module of the audit complex with connection from an external Internet network and with at least one switch with a wireless connection, and the latter is connected to, of at least one audit module set with a wireless connection.

Thus, a comprehensive system for auditing and monitoring information security of a local area network of an enterprise, comprising at least one server with a central database, at least one local area network switch connected to at least two personal computers, at least one switch with a wireless connection and an Internet router, at least one module of an audit complex, an audit complex with a wireless connection and an audit complex with connected eat from an external Internet network, while at least one local area network switch connected to at least two personal computers is connected to at least one module of the audit complex and to the Internet router, the latter connected to at least one server with a central database with at least one module of the audit complex with connection from an external Internet network and with at least one switch with a wireless connection, and the latter is connected to at least at least one module of the audit complex with a wireless connection, based on a single-board computer with a modular scheme for connecting to a local area network (LAN) of an enterprise, depending on the network architecture for auditing or monitoring the structure of a LAN of an enterprise, makes it possible to determine unauthorized access with high reliability and accuracy to enterprise information.

Brief Description of the Drawings

The drawing shows a diagram of an integrated system for auditing and monitoring information security of a local area network of an enterprise, general view.

The implementation of the invention

A comprehensive audit and monitoring system for information security of an enterprise’s local area network contains at least one server 1 with a central database, at least one local area network switch 2 connected to at least two personal computers (PCs) 3 and 4, at least one switch 5 with a wireless connection and an Internet router 6 (not shown in FIG.), while the complex system is additionally equipped with at least one module 7 of the audit complex, at least one module 8 of the audit complex with a wireless connection and at least one module 9 of the audit complex with a connection from an external Internet network, at least one switch 2 of the local area network connected to at least two personal computers 3 and 4, respectively, connected to at least one module 7 of the audit complex using Ethernet technology (IEEE 802.3 standard), gaining access to all resources available from this subnet and to the Internet router 6 to provide communication network, while the latter is connected to at least one server 1 with a central database, with at least one module 9 of the audit complex with connection from an external Internet network from the Internet provider to study the availability of enterprise resources from the outside, then there is from the Internet and with at least one switch 5 with a wireless connection to study the availability of enterprise resources through a wireless connection, and the latter is connected to at least one module 8 of the audit complex with a wireless connection by reading.

A comprehensive system for auditing and monitoring information security of a local area network of an enterprise operates as follows. At least one switch 2 of the local area network connected to at least two personal computers 3 and 4, for the employees to work, is connected to at least one module 7 of the audit complex, an Internet router 6, to which connect at least one server 1 with a central database, at least one module 9 of the audit complex with connection from an external Internet network, at least one switch 5 with a wireless connection for studying the availability of enterprise resources through b a wireless connection, and at least one module 8 of the audit complex with a wireless connection is connected to the latter, then each one connected with at least one module 7, 8 and 9 (module 7 of the audit complex, module 8 of the audit complex with wireless connection , module 9 of the audit complex with connection from an external Internet network) scans all personal computers 3 and 4 and at least one server 1 with a central database, determining which are located on PCs 3 and 4 and at least one server 1 with central Data base, network services: file storages, web servers, print servers, remote access services and other programs that interact with Internet resources, after which each of at least one modules 7, 8 and 9 generates its own report Including information about discovered network services. To view the report generated by at least one module 7, 8 and 9, they are connected using remote access (not shown in FIG.), Respectively, to at least one module 7, 8 and 9, or they configure automatic sending by e-mail (not shown in FIG.). Having received a list of available equipment and network services programs, each of at least one module 7, 8, 9 starts checking the software used for known vulnerabilities, and also tries to find passwords, thereby checking their durability, the results are also collected in report and supplement with recommendations on eliminating found vulnerabilities and increasing password strength.

At least one module 7, 8, and 9 operate independently of each other, since the network services available and discovered by them can differ significantly, which depends on the existing configuration of the local computer network of the enterprise.

Thus, simplification of the design, small size and power consumption, embeddedness and inconspicuous location are achieved due to the use of a single-board computer, and accurate detection of existing vulnerabilities using which an attacker can gain unauthorized access to company information is achieved due to the features of the proposed connection, at least , one module 7 of the audit complex, module 8 of the audit complex with wireless connection, module 9 of the audit complex with connection from external there are Internet modules, at least one module 7 of the audit complex analyzes network services available from at least two PCs 3 and 4, module 8 of the audit complex with wireless connection analyzes network services available from wi-fi enterprise network, and module 9 of the audit complex with connection from an external network of Internet modules analyzes network services available from an external Internet network.

The invention in comparison with the prototype and other known technical solutions has the following advantages:

- simplification of the design;

- small size and power consumption;

- embeddability and inconspicuous location;

- accurate detection of existing vulnerabilities, using which an attacker can gain unauthorized access to company information.

Claims (1)

A comprehensive system for auditing and monitoring information security of a local area network of an enterprise, comprising a server with a central database, at least one local area network switch connected to at least two personal computers, a wireless switch and an Internet router, characterized in the fact that it is additionally equipped with at least one module of an audit complex, an audit complex with a wireless connection and an audit complex with a connection from an external Internet network, wherein at least one local area network switch connected to at least two personal computers is connected to at least one module of the audit complex and to an Internet router, the latter being connected to at least one server with a central database with at least one module of the audit complex with connection from an external Internet network and with at least one switch with a wireless connection, and the latter is connected to at least , one module of the audit complex with a wireless connection.