Implementing and evaluating a GDPR-compliant open-source SIEM solution

• Main Authors: Costa, R.L.D.C (Author), Rabadão, C. (Author), Santos, L. (Author), Vazão, A.P (Author)
• Format: Article
• Language: English
• Published: Elsevier Ltd 2023
• Subjects: Complex networks; Compliance control; Confidential data; Data privacy; Device application; Elastic stack; GDPR; General data protection regulations; Information management; IT infrastructures; Network environments; Open-source; Pseudonymization; Real-world networks; Security Information and Event Management; Security information and event managements
• Online Access: View Fulltext in Publisher; View in Scopus

 Security Information and Event Management (SIEM) solutions collect events from the IT infrastructure and concentrate information from the various components in a single place, allowing the detection of anomalous situations and attacks, and helping to protect confidential data. But real-world network environments may be complex and heterogeneous (e.g., in terms of devices, applications, and operating systems), and the attack surface can be vast, which makes increases the amount that a SIEM solution must collect and analyze. The General Data Protection Regulation (GDPR) has increased the level of complexity in such context, as organizations must ensure the monitoring of access to personal data and various levels of security in their infrastructure. In this work, we deal with the implementation of an open-source SIEM solution that incorporates technical measures for the protection and control of personal data, ensuring compliance with the GDPR. We identify the main functionalities and describe a solution based on the Elastic Stack and additional open-source external tools. To validate our proposals, we implemented a prototype of our solution in a real-world environment. We simulated internal and external attacks that show the solution capacity to deal in real-time with the detection of threats and incidents. We also evaluated the performance and resource consumption of personal data pseudonymization processes. Obtained results show our solution presents good performance and scalability. © 2023 The Author(s)