1
$\begingroup$

How can companies authenticate messages sent between different security components in the company? (say SIEM for monitoring and IDS for intrusion detection)?

What protocols do they use in order to protect their authentication against an adversary who impersonate to other security component in the company?

$\endgroup$

1 Answer 1

1
$\begingroup$

Usually point-to-point transport security is used for this. The most well known protocol is of course TLS, but there is also SSH, IPsec etc. etc. TLS works directly between two computers (although intermediate machines may of course route the IP packets from one to the other, without decrypting).

For communication between computer systems you would generally need client and server authentication. A public key infrastructure based on certificates (PKIX) makes most sense for the entity authentication part.

In addition end-to-end application level security may be used. This is simply wrapping up each message in a container such as a CMS container or XML signing and encryption. This way the message may be protected from the intended sender to the intended receiver, regardless of the protocols and hubs in between. It also has the advantage that a message can be protected before being send or being received.

There are too many protocols to name here otherwise. You'll have to look them up yourself. There is - to my knowledge - no generally accepted protocol for communicating between a SIEM and IDS.

$\endgroup$
4
  • $\begingroup$ I got it, so the protocol chosen by the company between the components is the company's choise among various of authentication protocols. There is no one special protocol dedicated to transmitting between components (like http to send html data). $\endgroup$
    – Adi Ml
    Commented Feb 23, 2017 at 10:58
  • $\begingroup$ Right. And note that you can send HTML over FTP as well; you would not necessarily want to but you can... There is no one standard to rule them all. Webservices and enterprise service busses are of course rather prevalent nowadays. Those xan certainly be protected using cryptography. $\endgroup$
    – Maarten Bodewes
    Commented Feb 23, 2017 at 11:09
  • $\begingroup$ is the xml signing relevant only when there are a web server? or among security components too? $\endgroup$
    – Adi Ml
    Commented Feb 23, 2017 at 12:48
  • $\begingroup$ Mainly used in business to business (b2b) communications with 2 application servers. Look up WS-Security. Maarten out, for more info read into the matter or hire a consultant. $\endgroup$
    – Maarten Bodewes
    Commented Feb 23, 2017 at 12:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.