Extreme Requirements
One of Europe’s largest energy providers meets a BalaBit solution
- By Gábor Marosvári
- May 01, 2016
The CEZ Group Nuclear Power Plant’s recent
challenges included monitoring an
increasing number of devices, increasing
productivity while reducing headcount,
and protecting the confidentiality of documents
about the new block of the nuclear
power plant under construction—all of
which called for a heavyweight solution to optimize their
SIEM and authorize privileged users (administrators, third
parties, VDI users) and record administrative sessions. The
challenge was accepted by BalaBit’s syslog-ng Store Box
log management appliance and Shell Control Box privileged
user monitoring solutions.
Introducing the Customer:
A Nuclear Power Plant
The CEZ Group is one of the largest energy companies in Eastern
and Southern Europe. Its main business is the production,
distribution and sale of electricity and heat. It employs 30,000
people, operates in 10 countries in the region, and serves approximately
9.3 million customers. In terms of its market size based on customers, CEZ Group is the 7th largest energy company in
Europe. CEZ ICT Services, a subsidiary of CEZ, provides information
and telecommunications services for the entire group.
High Security Standards in the
Nuclear Power Plant to Prevent
Leakage of Information
CEZ recently faced several challenges, including a large increase
of IT devices to be monitored, pressure to increase work efficiency
and reduce the number of employees at the same time. They
also wished to improve the security of the document management
system of a special team who would select the general contractor
for building the new blocks of the nuclear power plant in
Temelín. Team members work on VDI-clients to access a Share-
Point application to collect, process and evaluate all documents
arriving from tender candidates. CEZ management specified strict
IT and legal security requirements against this system to avoid
legal disputations or possible lawsuits later
Consequently, CEZ needed a heavyweight solution to meet
two key expectations: advanced management of logs and audit
of privileged users.
“Our main goal was to prevent leakage of information or any
action which would harm our IT system,” said Pavel Hejduk,
head of the ICT Security Department for CEZ ICT Services.
“These incidents could have led us to choose another contractor
for building the new blocks of the power plant, which represented
a great security risk for us.”
Requirements of the log management part of the new project,
meeting the more strict regulations were web-GUI, fast log
search, easy backup/archive of logs, WORM (Write Once Read
Many) log storage, encryption and time stamping of logs, and
high availability (HA) support.
Requirements of the auditing part of the new project, meeting
the more strict regulations, included a single tool capable of authorizing
administrators and recording administrative sessions,
and support of all standard remote administration protocols
such as SSH, Citrix ICA and RDP.
A Solid Combination of
BalaBit Technologies
Previously the plant’s IT team was using the syslog-ng Open
Source Edition log management tool to optimize their SIEM solution’s
performance, but the due to the new requirements they
needed to look for a commercial solution. They choose BalaBit’s
syslog-ng Store Box (SSB) appliance.
“With syslog-ng Store Box you get a real log management
tool without the need to know Linux/Unix, unlike with other
tools on the market,” Hejduk said. “SSB is a log management
tool, and that’s exactly what it does. Many competitors are talking
about log management, but, actually, their solutions are
event management. If you have, for example, 40 types of logs,
implementation of an event management solution is a painful
and time-consuming exercise. In the same scenario, SSB can be
implemented in a few days.”
Log Management solutions implemented by CEZ:
- A high availability SSB cluster to collect the log messages of
their production systems including 250 log source hosts.
- An additional SSB virtual appliance that runs on the VMware
ESX platform for testing and development.
- syslog-ng Agent for Windows with TLS encryption and mutual
authentication to collect logs from Windows servers.
CEZ choose BalaBit’s Shell Control Box (SCB) activity monitoring
appliance, as they did not find any competitive offering for
transparently auditing privileged users. SCB audits and monitors
the administrative access to more than one hundred servers and
external communication stations (communication stations are
special thin clients with strict policies, such as controlled email
for example).
“Shell Control Box brought much more than we expected. It
is not only an auditing solution, but an advanced authorization
and OCr search tool, as well,” Hejduk said. “With its transparent
Man-In-The-Middle architecture, SCB is a unique product
on the market. Support of SSH/ICA/RDP/HTTP(S) auditing
and replaying, as well as OCR-based indexing and searching in a
single box is amazing.”
In terms of auditing privileged users’ activities, CEZ implemented
a high availability SCB cluster; an additional SCB virtual
appliance was also purchased for testing purposes.
The new log management and auditing solutions serve 150
users and 50 thin clients simultaneously, monitor eight IT and
security administrators, and protect 100 servers in 3 environments
(production, test, development). Supported by strict SLA,
the production environment is “hermetically” separated from the
outside world (no Internet, no phones, no papers, etc.).
Fast Implementation
Planning, testing and implementation of the whole project took
two months. The new BalaBit solutions have been in productive
operation since July 2012.
The SSB log server appliance was easy to deploy and configure.
Archiving logs to WORM media and fast log search was a
perfect combination for CEZ security experts for daily operations
management and forensics investigations, as well. Indexing of
logs based on B-trees* results in extremely fast searching for any
parts of the VDI-client and Active Directory server logs.
SCB was a bit harder to implement, but easy to operate. CEZ
benefits not just from its primary function (user authorization,
audit and record sessions), but from a secondary one, as well - it
provides complete documentation and replay of all configuration
changes performed by implementation partners and internal administrators.
This article originally appeared in the May 2016 issue of Security Today.