Toward cyber situational awareness with open source software

Kohti kybertilannetietoisuutta avoimen lähdekoodin ohjelmistojen avulla. Tilannetietoisuuden konsepti ja sen kriittisyys päätöksenteossa ymmärrettiin alun perin ilmailussa kuvaamaan olennaisten elementtien havaitsemista, niiden merkityksen ymmärtämistä sekä niiden käyttäytymistä ajan kuluessa. Ti...

Full description

Bibliographic Details
Main Author: Teriö, Jarkko
Other Authors: Informaatioteknologian tiedekunta, Faculty of Information Technology, Informaatioteknologia, University of Jyväskylä, Jyväskylän yliopisto
Format: Master's thesis
Language:eng
Published: 2017
Subjects:
Online Access: https://jyx.jyu.fi/handle/123456789/55920
_version_ 1826225738869637120
author Teriö, Jarkko
author2 Informaatioteknologian tiedekunta Faculty of Information Technology Informaatioteknologia University of Jyväskylä Jyväskylän yliopisto
author_facet Teriö, Jarkko Informaatioteknologian tiedekunta Faculty of Information Technology Informaatioteknologia University of Jyväskylä Jyväskylän yliopisto Teriö, Jarkko Informaatioteknologian tiedekunta Faculty of Information Technology Informaatioteknologia University of Jyväskylä Jyväskylän yliopisto
author_sort Teriö, Jarkko
datasource_str_mv jyx
description Kohti kybertilannetietoisuutta avoimen lähdekoodin ohjelmistojen avulla. Tilannetietoisuuden konsepti ja sen kriittisyys päätöksenteossa ymmärrettiin alun perin ilmailussa kuvaamaan olennaisten elementtien havaitsemista, niiden merkityksen ymmärtämistä sekä niiden käyttäytymistä ajan kuluessa. Tilannetietoisuus modernissa kybermaailmassa voidaan määritellä kybermaailman ymmärtämiseksi, siellä piilevien uhkien havaitsemiseksi sekä niiden merkityksen käsittämiseksi valtiollisella, organisatorisella sekä jopa yksilöllisellä tasolla. Organisaation tasolla tuloksia tuottava kybertilannetietoisuus tarjoaa vastauksia kysymyksiin: Mitä järjestelmiä ja sovelluksia on käytössä? Olemmeko haavoittuvaisia? Mitä tulisi tehdä? Tietomurron jälkeen kybertilannetietoisuus tarjoaa vastauksia kysymyksiin: Mitä on tapahtunut? Kuinka se vaikuttaa organisaation toimintaan ja mitä tulisi tehdä tilanteen korjaamiseksi? Ajantasainen tilannetietoisuus mahdollistaa organisaatiolle nopean havainnointi- ja reagointikyvyn uusia haavoittuvuuksia ja hyökkäyksiä vastaan, mahdollistaen tehokkaamman ja faktapohjaisen päätöksenteon organisaation uniikissa kyberympäristössä. Kybertilannetietoisuus on tärkeässä roolissa puolustauduttaessa kehittyneitä hyökkäyksiä ja jatkuvasti paremmin varustautuneita hyökkääjiä vastaan. Tehokas kybertilannetietoisuuskyky on edellytys nopeille ja täsmällisille päätöksille. Tämä tutkielma pyrkii kuvaamaan, kuinka kybertilannetietoisuuskyky saavutetaan hyödyntämällä avoimen lähdekoodin ohjelmistoja. Tutkielmassa kuvataan tarvittavat elementit, datan kerääminen, analysointi ja visualisointi, sekä kybertilannetietoisuuden hyödyt päätöksentekijöille. Tutkielmassa hyödynnetään suunnittelutieteellistä tutkimusmenetelmää suunniteltaessa ja rakennettaessa ratkaisua, jonka demonstroinnilla todennetaan sen sopivuus kybertilannetietoisuuden luomiseksi. Tuloksena on avoimen lähdekoodin ohjelmistoja hyödyntävä järjestelmä kybertilannetietoisuuden luomiseksi ympäristössä, joka koostuu hallintapalvelimesta sekä kahdesta asiakaspalvelimesta. Tutkielman tuloksena syntyy kuvaus avoimen lähdekoodin ohjelmistojen hyödyntämisessä kybertilannetietoisuuden rakentamisessa. Tutkielmassa listataan myös aiheita jatkotutkimukselle. The concept of situational awareness and its criticality to decision-making was initially recognized in the context of aviation to describe the perception of relevant elements, comprehension of their meaning and finally, projecting their near future states. Bringing this concept into modern cyber environment, cyber situational awareness can be simply expressed as knowing the cyber environment, what the threats are and what their potential impact is on a state, organizational or even individual level. On an organizational level, effective cyber situational awareness yield answers to questions such as: What systems and applications we currently have? Are we vulnerable? What should we do? After an incident, effective cyber situational awareness provides input for questions such as: What has happened? How it affects the organization’s performance and what actions should be taken in order to remediate the situation? Up-to-date situational awareness enables organizations to detect, respond and prioritize remediation efforts to emerging threats such as new vulnerabilities and ongoing attacks, resulting in more efficient decision-making based on facts and the unique characteristics of the organization’s cyber environment. Cyber situational awareness plays a crucial role in defending against today’s sophisticated attacks and increasingly more resourceful adversaries. Effective cyber situational awareness capability is a prerequisite for swift and accurate decisions. This study aims to describe how cyber situational awareness capability can be achieved using open source software. It details the necessary elements, data collection, analysis and visualization, as well as the benefits cyber situational awareness brings to decision-makers. The study utilizes design science research process to design and develop a solution used in demonstration to verify its suitability for achieving cyber situational awareness. The end result is a system utilizing open source software to form cyber situational awareness on a network consisting of manager server and two client servers. Research findings have practical significance by detailing one open source solution for building cyber situational awareness. Topics for future research avenues are also discussed.
first_indexed 2023-03-22T09:57:20Z
format Pro gradu
fullrecord [{"key": "dc.contributor.advisor", "value": "H\u00e4m\u00e4l\u00e4inen, Timo", "language": "", "element": "contributor", "qualifier": "advisor", "schema": "dc"}, {"key": "dc.contributor.author", "value": "Teri\u00f6, Jarkko", "language": null, "element": "contributor", "qualifier": "author", "schema": "dc"}, {"key": "dc.date.accessioned", "value": "2017-11-18T14:58:44Z", "language": "", "element": "date", "qualifier": "accessioned", "schema": "dc"}, {"key": "dc.date.available", "value": "2017-11-18T14:58:44Z", "language": "", "element": "date", "qualifier": "available", "schema": "dc"}, {"key": "dc.date.issued", "value": "2017", "language": null, "element": "date", "qualifier": "issued", "schema": "dc"}, {"key": "dc.identifier.other", "value": "oai:jykdok.linneanet.fi:1802818", "language": null, "element": "identifier", "qualifier": "other", "schema": "dc"}, {"key": "dc.identifier.uri", "value": "https://jyx.jyu.fi/handle/123456789/55920", "language": "", "element": "identifier", "qualifier": "uri", "schema": "dc"}, {"key": "dc.description.abstract", "value": "Kohti kybertilannetietoisuutta avoimen l\u00e4hdekoodin ohjelmistojen avulla.\r\n\r\nTilannetietoisuuden konsepti ja sen kriittisyys p\u00e4\u00e4t\u00f6ksenteossa ymm\u00e4rrettiin alun perin ilmailussa kuvaamaan olennaisten elementtien havaitsemista, niiden merkityksen ymm\u00e4rt\u00e4mist\u00e4 sek\u00e4 niiden k\u00e4ytt\u00e4ytymist\u00e4 ajan kuluessa. Tilannetietoisuus modernissa kybermaailmassa voidaan m\u00e4\u00e4ritell\u00e4 kybermaailman ymm\u00e4rt\u00e4miseksi, siell\u00e4 piilevien uhkien havaitsemiseksi sek\u00e4 niiden merkityksen k\u00e4sitt\u00e4miseksi valtiollisella, organisatorisella sek\u00e4 jopa yksil\u00f6llisell\u00e4 tasolla. Organisaation tasolla tuloksia tuottava kybertilannetietoisuus tarjoaa vastauksia kysymyksiin: Mit\u00e4 j\u00e4rjestelmi\u00e4 ja sovelluksia on k\u00e4yt\u00f6ss\u00e4? Olemmeko haavoittuvaisia? Mit\u00e4 tulisi tehd\u00e4? Tietomurron j\u00e4lkeen kybertilannetietoisuus tarjoaa vastauksia kysymyksiin: Mit\u00e4 on tapahtunut? Kuinka se vaikuttaa organisaation toimintaan ja mit\u00e4 tulisi tehd\u00e4 tilanteen korjaamiseksi?\r\n\r\nAjantasainen tilannetietoisuus mahdollistaa organisaatiolle nopean havainnointi- ja reagointikyvyn uusia haavoittuvuuksia ja hy\u00f6kk\u00e4yksi\u00e4 vastaan, mahdollistaen tehokkaamman ja faktapohjaisen p\u00e4\u00e4t\u00f6ksenteon organisaation uniikissa kyberymp\u00e4rist\u00f6ss\u00e4. Kybertilannetietoisuus on t\u00e4rke\u00e4ss\u00e4 roolissa puolustauduttaessa kehittyneit\u00e4 hy\u00f6kk\u00e4yksi\u00e4 ja jatkuvasti paremmin varustautuneita hy\u00f6kk\u00e4\u00e4ji\u00e4 vastaan. Tehokas kybertilannetietoisuuskyky on edellytys nopeille ja t\u00e4sm\u00e4llisille p\u00e4\u00e4t\u00f6ksille.\r\n\r\nT\u00e4m\u00e4 tutkielma pyrkii kuvaamaan, kuinka kybertilannetietoisuuskyky saavutetaan hy\u00f6dynt\u00e4m\u00e4ll\u00e4 avoimen l\u00e4hdekoodin ohjelmistoja. Tutkielmassa kuvataan tarvittavat elementit, datan ker\u00e4\u00e4minen, analysointi ja visualisointi, sek\u00e4 kybertilannetietoisuuden hy\u00f6dyt p\u00e4\u00e4t\u00f6ksentekij\u00f6ille.\r\n\r\nTutkielmassa hy\u00f6dynnet\u00e4\u00e4n suunnittelutieteellist\u00e4 tutkimusmenetelm\u00e4\u00e4 suunniteltaessa ja rakennettaessa ratkaisua, jonka demonstroinnilla todennetaan sen sopivuus kybertilannetietoisuuden luomiseksi. Tuloksena on avoimen l\u00e4hdekoodin ohjelmistoja hy\u00f6dynt\u00e4v\u00e4 j\u00e4rjestelm\u00e4 kybertilannetietoisuuden luomiseksi ymp\u00e4rist\u00f6ss\u00e4, joka koostuu hallintapalvelimesta sek\u00e4 kahdesta asiakaspalvelimesta. Tutkielman tuloksena syntyy kuvaus avoimen l\u00e4hdekoodin ohjelmistojen hy\u00f6dynt\u00e4misess\u00e4 kybertilannetietoisuuden rakentamisessa. Tutkielmassa listataan my\u00f6s aiheita jatkotutkimukselle.", "language": "fi", "element": "description", "qualifier": "abstract", "schema": "dc"}, {"key": "dc.description.abstract", "value": "The concept of situational awareness and its criticality to decision-making was initially recognized in the context of aviation to describe the perception of relevant elements, comprehension of their meaning and finally, projecting their near future states. Bringing this concept into modern cyber environment, cyber situational awareness can be simply expressed as knowing the cyber environment, what the threats are and what their potential impact is on a state, organizational or even individual level. On an organizational level, effective cyber situational awareness yield answers to questions such as: What systems and applications we currently have? Are we vulnerable? What should we do? After an incident, effective cyber situational awareness provides input for questions such as: What has happened? How it affects the organization\u2019s performance and what actions should be taken in order to remediate the situation?\r\n\r\nUp-to-date situational awareness enables organizations to detect, respond and prioritize remediation efforts to emerging threats such as new vulnerabilities and ongoing attacks, resulting in more efficient decision-making based on facts and the unique characteristics of the organization\u2019s cyber environment. Cyber situational awareness plays a crucial role in defending against today\u2019s sophisticated attacks and increasingly more resourceful adversaries. Effective cyber situational awareness capability is a prerequisite for swift and accurate decisions.\r\n\r\nThis study aims to describe how cyber situational awareness capability can be achieved using open source software. It details the necessary elements, data collection, analysis and visualization, as well as the benefits cyber situational awareness brings to decision-makers. \r\n\r\nThe study utilizes design science research process to design and develop a solution used in demonstration to verify its suitability for achieving cyber situational awareness. The end result is a system utilizing open source software to form cyber situational awareness on a network consisting of manager server and two client servers. Research findings have practical significance by detailing one open source solution for building cyber situational awareness. Topics for future research avenues are also discussed.", "language": "en", "element": "description", "qualifier": "abstract", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Submitted using Plone Publishing form by Jarkko Teri\u00f6 (jaheteri) on 2017-11-18 14:58:42.824984. Form: Pro gradu -lomake (https://kirjasto.jyu.fi/julkaisut/julkaisulomakkeet/pro-gradu-lomake). JyX data: [jyx_publishing-allowed (fi) =False]", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Submitted by jyx lomake-julkaisija (jyx-julkaisija.group@korppi.jyu.fi) on 2017-11-18T14:58:43Z\r\nNo. of bitstreams: 2\r\nURN:NBN:fi:jyu-201711184291.pdf: 3051788 bytes, checksum: e3634421b2842b6ef109a7f0de169682 (MD5)\r\nlicense.html: 1138 bytes, checksum: fec967a51ec0971aa97c92e681a90d1e (MD5)", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Made available in DSpace on 2017-11-18T14:58:44Z (GMT). No. of bitstreams: 2\r\nURN:NBN:fi:jyu-201711184291.pdf: 3051788 bytes, checksum: e3634421b2842b6ef109a7f0de169682 (MD5)\r\nlicense.html: 1138 bytes, checksum: fec967a51ec0971aa97c92e681a90d1e (MD5)\r\n Previous issue date: 2017", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.format.extent", "value": "1 verkkoaineisto (56 sivua)", "language": null, "element": "format", "qualifier": "extent", "schema": "dc"}, {"key": "dc.format.mimetype", "value": "application/pdf", "language": null, "element": "format", "qualifier": "mimetype", "schema": "dc"}, {"key": "dc.language.iso", "value": "eng", "language": null, "element": "language", "qualifier": "iso", "schema": "dc"}, {"key": "dc.rights", "value": "In Copyright", "language": "en", "element": "rights", "qualifier": null, "schema": "dc"}, {"key": "dc.subject.other", "value": "tilannetietoisuus", "language": null, "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "cyber security", "language": null, "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "situational awareness", "language": null, "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "situation awareness", "language": null, "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.title", "value": "Toward cyber situational awareness with open source software", "language": null, "element": "title", "qualifier": null, "schema": "dc"}, {"key": "dc.type", "value": "master thesis", "language": null, "element": "type", "qualifier": null, "schema": "dc"}, {"key": "dc.identifier.urn", "value": "URN:NBN:fi:jyu-201711184291", "language": null, "element": "identifier", "qualifier": "urn", "schema": "dc"}, {"key": "dc.type.ontasot", "value": "Pro gradu -tutkielma", "language": "fi", "element": "type", "qualifier": "ontasot", "schema": "dc"}, {"key": "dc.type.ontasot", "value": "Master\u2019s thesis", "language": "en", "element": "type", "qualifier": "ontasot", "schema": "dc"}, {"key": "dc.contributor.faculty", "value": "Informaatioteknologian tiedekunta", "language": "fi", "element": "contributor", "qualifier": "faculty", "schema": "dc"}, {"key": "dc.contributor.faculty", "value": "Faculty of Information Technology", "language": "en", "element": "contributor", "qualifier": "faculty", "schema": "dc"}, {"key": "dc.contributor.department", "value": "Informaatioteknologia", "language": "fi", "element": "contributor", "qualifier": "department", "schema": "dc"}, {"key": "dc.contributor.organization", "value": "University of Jyv\u00e4skyl\u00e4", "language": "en", "element": "contributor", "qualifier": "organization", "schema": "dc"}, {"key": "dc.contributor.organization", "value": "Jyv\u00e4skyl\u00e4n yliopisto", "language": "fi", "element": "contributor", "qualifier": "organization", "schema": "dc"}, {"key": "dc.subject.discipline", "value": "Tietojenk\u00e4sittelytiede", "language": "fi", "element": "subject", "qualifier": "discipline", "schema": "dc"}, {"key": "dc.date.updated", "value": "2017-11-18T14:58:44Z", "language": "", "element": "date", "qualifier": "updated", "schema": "dc"}, {"key": "yvv.contractresearch.funding", "value": "0", "language": "", "element": "contractresearch", "qualifier": "funding", "schema": "yvv"}, {"key": "dc.type.coar", "value": "http://purl.org/coar/resource_type/c_bdcc", "language": null, "element": "type", "qualifier": "coar", "schema": "dc"}, {"key": "dc.rights.accesslevel", "value": "restrictedAccess", "language": "fi", "element": "rights", "qualifier": "accesslevel", "schema": "dc"}, {"key": "dc.type.publication", "value": "masterThesis", "language": null, "element": "type", "qualifier": "publication", "schema": "dc"}, {"key": "dc.subject.oppiainekoodi", "value": "601", "language": null, "element": "subject", "qualifier": "oppiainekoodi", "schema": "dc"}, {"key": "dc.subject.yso", "value": "kyberturvallisuus", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "haavoittuvuus", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "tilannekuva", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "varautuminen", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "suojautuminen", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "j\u00e4rjestelm\u00e4arkkitehtuuri", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "ohjelmistot", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "avoin l\u00e4hdekoodi", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.format.content", "value": "fulltext", "language": null, "element": "format", "qualifier": "content", "schema": "dc"}, {"key": "dc.rights.url", "value": "https://rightsstatements.org/page/InC/1.0/", "language": null, "element": "rights", "qualifier": "url", "schema": "dc"}, {"key": "dc.rights.accessrights", "value": "Aineistoon p\u00e4\u00e4sy\u00e4 on rajoitettu tekij\u00e4noikeussyist\u00e4. Aineisto on luettavissa Jyv\u00e4skyl\u00e4n yliopiston kirjaston arkistoty\u00f6asemalta. Ks. https://kirjasto.jyu.fi/fi/tyoskentelytilat/laitteet-ja-tilat.", "language": "fi", "element": "rights", "qualifier": "accessrights", "schema": "dc"}, {"key": "dc.rights.accessrights", "value": "This material has a restricted access due to copyright reasons. It can be read at the workstation at Jyv\u00e4skyl\u00e4 University Library reserved for the use of archival materials: https://kirjasto.jyu.fi/en/workspaces/facilities.", "language": "en", "element": "rights", "qualifier": "accessrights", "schema": "dc"}, {"key": "dc.type.okm", "value": "G2", "language": null, "element": "type", "qualifier": "okm", "schema": "dc"}]
id jyx.123456789_55920
language eng
last_indexed 2025-02-18T10:54:21Z
main_date 2017-01-01T00:00:00Z
main_date_str 2017
publishDate 2017
record_format qdc
source_str_mv jyx
spellingShingle Teriö, Jarkko Toward cyber situational awareness with open source software tilannetietoisuus cyber security situational awareness situation awareness Tietojenkäsittelytiede 601 kyberturvallisuus haavoittuvuus tilannekuva varautuminen suojautuminen järjestelmäarkkitehtuuri ohjelmistot avoin lähdekoodi
title Toward cyber situational awareness with open source software
title_full Toward cyber situational awareness with open source software
title_fullStr Toward cyber situational awareness with open source software Toward cyber situational awareness with open source software
title_full_unstemmed Toward cyber situational awareness with open source software Toward cyber situational awareness with open source software
title_short Toward cyber situational awareness with open source software
title_sort toward cyber situational awareness with open source software
title_txtP Toward cyber situational awareness with open source software
topic tilannetietoisuus cyber security situational awareness situation awareness Tietojenkäsittelytiede 601 kyberturvallisuus haavoittuvuus tilannekuva varautuminen suojautuminen järjestelmäarkkitehtuuri ohjelmistot avoin lähdekoodi
topic_facet 601 Tietojenkäsittelytiede avoin lähdekoodi cyber security haavoittuvuus järjestelmäarkkitehtuuri kyberturvallisuus ohjelmistot situation awareness situational awareness suojautuminen tilannekuva tilannetietoisuus varautuminen
url https://jyx.jyu.fi/handle/123456789/55920 http://www.urn.fi/URN:NBN:fi:jyu-201711184291
work_keys_str_mv AT teriöjarkko towardcybersituationalawarenesswithopensourcesoftware